{"id":9076,"date":"2025-12-10T10:03:35","date_gmt":"2025-12-10T10:03:35","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/10\/windows-cloud-files-mini-filter-driver-0-day-vulnerability-exploited-in-the-wild\/"},"modified":"2025-12-10T10:03:35","modified_gmt":"2025-12-10T10:03:35","slug":"windows-cloud-files-mini-filter-driver-0-day-vulnerability-exploited-in-the-wild","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/10\/windows-cloud-files-mini-filter-driver-0-day-vulnerability-exploited-in-the-wild\/","title":{"rendered":"Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild"},"content":{"rendered":"

Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Microsoft has released urgent security updates to address a zero-day vulnerability in the Windows Cloud Files Mini Filter<\/a> Driver (cldflt.sys<\/em>) that is currently being exploited in the wild.<\/p>\n

Assigned the identifier CVE-2025-62221<\/a>, this elevation of privilege flaw affects a wide range of Windows operating systems, from Windows 10 Version 1809 to the latest Windows 11 Version 25H2 and Windows Server 2025.<\/p>\n

The vulnerability has been rated Important with a CVSS v3.1 base score of 7.8, and Microsoft\u2019s advisory confirms that attackers are using functional exploit code to gain SYSTEM privileges on compromised machines.<\/p>\n

The vulnerability is described as a Use-After-Free weakness within the Cloud Files Mini Filter Driver, a kernel component responsible for managing \u201cplaceholders\u201d and synchronization for cloud storage services like OneDrive.<\/p>\n

This driver enables the operating system to treat cloud-stored files as local entries without downloading their full content, hydrating them only on access.<\/p>\n

The flaw allows a locally authenticated, low-privilege attacker to trigger a memory-corruption state, subsequently allowing them to execute arbitrary code with the highest system privileges.\u200b<\/p>\n

Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC) acknowledged the discovery<\/a>, noting that while the attack complexity is low and requires no user interaction, the attacker must have established local access to the target machine.<\/p>\n

Unlike remote code execution flaws, this vulnerability is likely being utilized as a secondary stage in attack chains, where adversaries have already gained a foothold and seek to escalate their privileges to persist or disable security controls.<\/p>\n

Affected Versions and Security Updates<\/strong><\/h2>\n

The following table outlines the affected Windows versions and the corresponding Knowledge Base (KB) articles released on December 9, 2025. Administrators should prioritize patching these systems immediately, given the confirmed active exploitation status.<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Product Family<\/th>\nVersion \/ Edition<\/th>\nKB Article (Security Update)<\/th>\nBuild Number<\/th>\n<\/tr>\n<\/thead>\n
Windows 11 & Server 2025<\/strong><\/td>\nVersion 25H2 (x64\/ARM64)<\/td>\n\nKB5072033<\/a> \/ KB5072014<\/a>\n<\/td>\n10.0.26200.7462<\/td>\n<\/tr>\n
<\/td>\nVersion 24H2 (x64\/ARM64)<\/td>\n\nKB5072033<\/a> \/ KB5072014<\/a>\n<\/td>\n10.0.26100.7462<\/td>\n<\/tr>\n
<\/td>\nVersion 23H2 (x64\/ARM64)<\/td>\nKB5071417<\/a><\/td>\n10.0.22631.6345<\/td>\n<\/tr>\n
<\/td>\nServer 2025 (Core)<\/td>\nKB5072033<\/a><\/td>\n10.0.26100.7462<\/td>\n<\/tr>\n
Windows 10<\/strong><\/td>\nVersion 22H2 (x64\/ARM64\/32-bit)<\/td>\nKB5071546<\/a><\/td>\n10.0.19045.6691<\/td>\n<\/tr>\n
<\/td>\nVersion 21H2 (x64\/ARM64\/32-bit)<\/td>\nKB5071546<\/a><\/td>\n10.0.19044.6691<\/td>\n<\/tr>\n
<\/td>\nVersion 1809 (x64\/32-bit)<\/td>\nKB5071544<\/a><\/td>\n10.0.17763.8146<\/td>\n<\/tr>\n
Windows Server<\/strong><\/td>\nServer 2022 (Standard & Core)<\/td>\n\nKB5071547<\/a> \/ KB5071413<\/a>\n<\/td>\n10.0.20348.4529<\/td>\n<\/tr>\n
<\/td>\nServer 2022, 23H2 Edition<\/td>\nKB5071542<\/a><\/td>\n10.0.25398.2025<\/td>\n<\/tr>\n
<\/td>\nServer 2019 (Standard & Core)<\/td>\nKB5071544<\/a><\/td>\n10.0.17763.8146<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

This zero-day vulnerability presents a significant risk to organizations relying on Windows infrastructure, particularly given the confirmed exploitation in the wild.<\/p>\n

The \u201cOfficial Fix\u201d remediation level indicates that standard security updates are sufficient to resolve the issue, and no temporary workarounds have been published.<\/p>\n

Security teams should verify that the specific build numbers listed above are reflected on their endpoints after the update deployment to ensure successful mitigation.<\/p>\n

The absence of required user interaction makes this an attractive vector for automated malware and advanced persistent threats (APTs) operating within a network.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Windows Cloud Files Mini Filter Driver 0-Day Vulnerability Exploited in the Wild Microsoft has released urgent security updates to address a zero-day vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys) that is currently being exploited in the wild. Assigned the identifier CVE-2025-62221, this elevation of privilege flaw affects a wide range of Windows […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648,395],"tags":[130],"class_list":["post-9076","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","category-windows","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9076"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9076"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9076\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}