Three Zero-Days and 57 Fixes: A Critical Year-End Patch Tuesday from Microsoft

This month’s Patch Tuesday delivers a modest-sized update, but with high-impact fixes. Microsoft has patched 57 vulnerabilities, including 3 zero-day flaws (one actively exploited and two publicly disclosed) along with several critical-severity bugs.

Here’s a quick breakdown by vulnerability type from this update:

Two vulnerabilities this month were rated Critical (both RCE).

• Overview: A use-after-free bug in the Cloud Files mini-filter driver used for Windows file-sync/placeholder functionality.
• Risk: Local attacker with valid (low-privilege) access can escalate to SYSTEM, allowing full system takeover.
• Exploitation status:Actively exploited in the wild; Microsoft confirmed pre-patch exploitation.

• Overview: A command-injection issue in the GitHub Copilot plugin for JetBrains IDEs that can be triggered via a “cross prompt injection” in untrusted files or MCP servers.
• Risk: Local code/command execution in the user’s environment; dangerous for developer workstations and CI systems that run commands from IDE contexts.
• Exploitation status:Publicly disclosed; Microsoft’s advisory lists it as a publicly disclosed zero-day. No confirmed active exploitation.

• Overview: A command-injection/script-execution risk tied to how Invoke-WebRequest parses web content. Pages with embedded scripts could cause script execution when parsed.
• Risk: Remote content retrieved by PowerShell could cause script execution in the user context, relevant for automation and scripted tasks.
• Exploitation status:Publicly disclosed; Microsoft documented the behavior change and recommended using -UseBasicParsing to avoid script execution. No confirmed active exploitation.

The December 2025 update impacts a wide range of Microsoft products and components, including but not limited to:

• Core Windows operating system (client and server)
• Windows system drivers (e.g. Cloud Files Mini Filter Driver)
• Windows services such as filter-driver based subsystems
• Microsoft Edge (Chromium-based), part of the month’s broader Edge patch set

Given the diversity of components, from filesystem and kernel drivers to user-space services and browser components, the patch affects desktop, server, cloud, and hybrid environments.

• Prioritize patching immediately: The active zero-day in the Cloud Files driver represents a high-risk privilege escalation path that’s already exploited.
• Ensure full coverage: Because the flaws span kernels, drivers, and services, patching must cover all Windows installations (clients and servers).
• Audit driver-dependent functionality: Some flaws affect low-level system drivers; organizations should verify that updates don’t disrupt workflows that rely on specialized drivers.
• Check hybrid & cloud environments: Especially for Windows VMs and systems with file-sync or filter-driver dependencies.
• Use defense-in-depth: Patching alone isn’t enough: ensure principle of least privilege, endpoint hardening, and log/alerting for suspicious privilege-escalation attempts.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.