PT-2025-50155 · Microsoft · Windows

Published 2025-12-09 · Updated 2026-03-10 · CVE-2025-62221

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to December 2025 Patch Tuesday

Description A use-after-free vulnerability exists in the Windows Cloud Files Mini Filter Driver. Successful exploitation of this issue allows an authorized attacker to elevate privileges locally, potentially gaining SYSTEM-level access. This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 30, 2025. The vulnerability is triggered when an attacker tampers with cloud file sync operations, such as those performed by OneDrive, to exploit the driver and gain elevated system privileges. The issue is related to a flaw in the cldflt.sys file. It is a use-after-free condition, where memory is accessed after it has been freed, leading to potential code execution.

Recommendations Apply the December 2025 Patch Tuesday update to all affected systems immediately.

Fix

LPE

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-15480

CVE-2025-62221

Affected Products

Windows

References · 65

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62221 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/727082 · Security Note
• https://msrc.microsoft.com/update-guide/en-us/advisory/CVE-2025-62221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62221 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-62221 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62221 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15480 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-62221 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221 · Vendor Advisory
• https://twitter.com/dailycve/status/1998809839741579359 · Twitter Post
• https://i.redd.it/pxmwjeuxlc6g1.jpeg · Reddit Post
• https://twitter.com/leonov_av/status/2013202557385007545 · Twitter Post
• https://reddit.com/r/Action1/comments/1pifro1/december_2025_patch_tuesday_overview · Reddit Post
• https://t.me/avleonovcom/1627 · Telegram Post
• https://t.me/cveNotify/145320 · Telegram Post