CVE-2025-62221KEV · OVERDUECWE-416

Microsoft Windows Use After Free Vulnerability

High · published December 9, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 84.6th percentile for exploit probability.

299
days past CISA
deadline
CVSS v3.1
7.8
EPSS
3%
Percentile
84.6
In the wild
Confirmed
What it is

⚡ A moment of negligence, and you've just handed the keys to your castle! This use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver could let an unauthorized attacker escalate their privileges locally. 🔥 Think of it like a restaurant staff member who forgets to lock the pantry. Now, anyone with access can waltz in and grab the chef's secret recipes, or worse, change them! An attacker could exploit this vulnerability to gain administrative privileges on the system. This means they could execute malicious code, steal sensitive data, or wreak havoc on the entire network – absolutely devastating!

Put simply

Think of it like a restaurant staff member who forgets to lock the pantry. Now, anyone with access can waltz in and grab the chef's secret recipes, or worse, change them! This vulnerability arises due to improper management of memory after it has been freed, allowing attackers to exploit this flaw to elevate their permissions and gain unauthorized control of the system.

What to do

An attacker could exploit this vulnerability to gain administrative privileges on the system. This means they could execute malicious code, steal sensitive data, or wreak havoc on the entire network – absolutely devastating! Immediate action is necessary! Apply the latest security patches provided by Microsoft for the affected Windows versions. Additionally, conduct a thorough review of permissions and access rights to prevent unauthorized access. 🛡️ You've got this! Stay proactive with these steps, and you'll reinforce your defenses in no time! 🚀

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02505 · 84.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-09T23:15Z
KEV added
2025-12-09 · due 2025-12-30
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (2)
EPSS history
Timeline
  • 09 DEC 17:56Z
    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
    cvelistv5
  • 09 DEC 00:00Z
    Added to CISA KEV — remediate by Dec 30
    kev