{"id":"CVE-2025-62221","kind":"vulnerability","aliases":["CVE-2025-62221"],"related":[],"title":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally","description":"Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A use-after-free bug in the Windows Cloud Files Mini Filter Driver lets an authorized local user corrupt memory and gain higher privileges. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2025-12-09T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.8146"],"affected":"< 10.0.17763.8146","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.6691"],"affected":"< 10.0.19044.6691","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.6691"],"affected":"< 10.0.19045.6691","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.6345"],"affected":"< 10.0.22631.6345","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.7392"],"affected":"< 10.0.26100.7392","ecosystem":"vendor"},{"name":"microsoft windows 11 25h2","fixed":["10.0.26200.7392"],"affected":"< 10.0.26200.7392","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.8146"],"affected":"< 10.0.17763.8146","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.4467"],"affected":"< 10.0.20348.4467","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":["10.0.25398.2025"],"affected":"< 10.0.25398.2025","ecosystem":"vendor"},{"name":"microsoft windows server 2025","fixed":["10.0.26100.7392"],"affected":"< 10.0.26100.7392","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2025-62221 per vendor instructions; the sources do not name the patched build.","status":"open","published_at":"2025-12-09T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:47+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:42:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2025-62221 per vendor instructions; the sources do not name the patched build.","reach":"local","summary":"A use-after-free bug in the Windows Cloud Files Mini Filter Driver lets an authorized local user corrupt memory and gain higher privileges. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with local low-privilege account gains SYSTEM-level control of the machine.","analyst_note":"Find the patched Windows build and KB number for CVE-2025-62221 in the Microsoft Security Update Guide (msrc.microsoft.com) and confirm the affected OS versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000427,"input_tokens":2529,"output_tokens":348,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':143C '-2025':20A,23A '-62221':21A,24A '10':29A,33A,37A '11':41A,45A,49A '1809':30A '2019':54A '2022':58A,62A '2025':67A '21h2':34A '22':142C '22h2':38A '23h2':42A,63A '24h2':46A '25h2':50A 'action':133C 'activ':103B 'allow':11A,123C 'appli':134C 'applic':140C 'attack':14A,126C 'author':13A,90B,125C 'bod':141C 'bug':79B 'cisa':99B,131C 'cloud':6A,83B,110C,146C 'contain':115C 'corrupt':93B 'cve':19A,22A 'discontinu':149C 'driver':10A,87B,114C 'elev':16A,128C 'exploit':68B,104B 'file':7A,84B,111C 'filter':9A,86B,113C 'follow':139C 'free':3A,78B,119C 'gain':96B 'guidanc':144C 'higher':97B 'host':72B 'infrastructur':69B 'instruct':138C 'let':88B 'list':100B 'local':18A,91B,130C 'memori':94B 'microsoft':25A,27A,31A,35A,39A,43A,47A,51A,55A,59A,64A,108C 'mini':8A,85B,112C 'mitig':135C,155C 'per':136C 'privileg':17A,98B,129C 'product':153C 'requir':132C 'self':71B 'self-host':70B 'server':53A,57A,61A,66A 'servic':147C 'unavail':157C 'use':1A,76B,117C,150C 'use-after-fre':75B 'user':92B 'vendor':137C 'vulner':120C 'wild':107B 'window':5A,73B,82B,109C 'windows':26A,28A,32A,36A,40A,44A,48A,52A,56A,60A,65A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-12-09T00:00:00+00:00","kev":{"dateAdded":"2025-12-09","dueDate":"2025-12-30","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-62221","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-62221","severity":null,"published_at":"2025-12-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-62221","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62221","severity":null,"published_at":"2025-12-09T18:15:56+00:00","modified_at":"2026-09-25T23:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}