CVE-2025-62221

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Sep 25, 2026

Description

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.8146
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.6691
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.6691
Microsoft	Windows 11 version 22H3	>= 10.0.22631.0, < 10.0.22631.6345
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.6345
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.7462
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.7462
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.8146
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.8146
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.4529
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	>= 10.0.25398.0, < 10.0.25398.2025
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.7462
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.7462

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62221US Government Resource

Timeline

Published: Dec 9, 2025
Last modified: Sep 25, 2026
Added to CISA KEV: Dec 9, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-622228.8Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an u CVE-2025-622234.3User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing CVE-2025-622243.5User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofin CVE-2025-622258.4Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write per CVE-2025-622288.8Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted ta CVE-2025-622297.3A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during noti CVE-2025-622307.3A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain d CVE-2025-622317.3A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function ca CVE-2025-622327.5Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sink CVE-2025-622336.3Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Versio CVE-2025-622358.1Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of ori CVE-2025-622365.3The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unaut