Monthly Fallout Report
December 2025 Fallout
57 vulnerabilities, one zero-day actively exploited, a PowerShell command injection hiding in web requests, and a security fix that broke MSMQ messaging for enterprises — nothing says Happy Holidays like queue failures.
Tired of patch chaos? Automox automates patching across Windows, Mac, and Linux — so you're never caught off guard on Patch Tuesday.
Try Free →Fallout Timeline
December’s 57 vulnerabilities include one actively exploited zero-day and two publicly disclosed. CVE-2025-62221 is the exploited one: a use-after-free in the Windows Cloud Files Mini Filter Driver (used by OneDrive, Google Drive, iCloud) that lets a local attacker escalate to SYSTEM. CISA added it to the KEV catalog with a December 30 remediation deadline. The two disclosed zero-days are CVE-2025-54100 — a PowerShell command injection that fires when Invoke-WebRequest parses a crafted web page (yes, just fetching a URL can execute code) — and CVE-2025-64671, a command injection in GitHub Copilot for JetBrains from the IDEsaster vulnerability class. December brings 1,275 CVEs patched for 2025 total — the second consecutive year over 1,000. Three Critical RCEs round out the severity list. Windows 11 KB5072033 and Windows 10 ESU KB5071546 are this month’s deployments. Enterprise admins: hold KB5071546 on MSMQ-dependent systems until you test — there’s a nasty surprise waiting for you in the 72-hour column.
Windows Cloud Files Mini Filter Driver use-after-free — EoP to SYSTEM. Used by OneDrive, Google Drive, iCloud — present even if none installed. CISA KEV deadline December 30. Short, easy path to full compromise once access is obtained.
PowerShell command injection via Invoke-WebRequest — fetching a crafted URL can execute arbitrary code. Microsoft added a warning prompt; admins should add -UseBasicParsing to all Invoke-WebRequest calls in scripts.
GitHub Copilot for JetBrains command injection — part of the IDEsaster vulnerability class targeting AI-augmented IDEs. Bypasses user-configured allow lists via a vulnerable execute-command tool.
MSMQ Elevation of Privilege — the security hardening for this CVE modified NTFS permissions on C:\Windows\System32\MSMQ\storage, breaking write access for IIS app pools, LocalService, and NetworkService accounts. The fix that broke enterprise messaging. See 72-hr timeline.
SharePoint RCE — affects on-premises SharePoint environments. Authenticated attacker can execute remote code via crafted requests. Patch before the holiday break; unattended SharePoint servers are a gift to attackers.
Sources: BleepingComputer · The Hacker News · Tenable
December’s Patch Tuesday is going to be remembered in enterprise IT circles for a long time. Within days of deploying KB5071546 (Windows 10 ESU/22H2), KB5071544 (Server 2019), and KB5071543 (Server 2016), MSMQ completely stopped working on affected systems. The security hardening for CVE-2025-62455 changed NTFS permissions on C:\Windows\System32\MSMQ\storage, stripping write access from non-admin service identities — IIS app pools, LocalService, NetworkService. The result: inactive queues, misleading “Insufficient disk space or memory” errors (when there’s plenty), IIS sites throwing HTTP 500s, and entire order-processing pipelines going dark. Microsoft confirmed the issue and initially directed all affected organizations to open a business support ticket for workaround guidance rather than publishing a public fix. than October’s dev catastrophe — but not silent. The most-reported issue: KB5068861 is causing laptops to freeze when waking from sleep, observed across Intel x64, AMD x64, and Qualcomm Snapdragon X (ARM64) devices. Multiple IT admins managing large fleets paused deployment across all tenants. ASUS ROG Ally X gamers hit install failures with errors 0x80071ab0 and 0x800f0991. Otherwise the update is clean — no major developer regressions, no localhost apocalypses., developers across Windows 11 24H2 and 25H2 discovered that localhost (127.0.0.1) was completely broken. Browser connections returned ERR_HTTP2_PROTOCOL_ERROR or ERR_CONNECTION_RESET. Visual Studio couldn't attach to IIS Express. The Duo Desktop authentication app stopped working. Autodesk Vault users couldn't connect to local servers. Root cause: a regression in HTTP.sys (the kernel-mode HTTP driver) that terminates HTTP/2 sessions on the loopback interface during handshake. A secondary regression broke WinRE — keyboards and mice stopped working in the Windows Recovery Environment, meaning if you needed to recover a broken PC, your input devices wouldn't work. Microsoft acknowledged the HTTP.sys issue on October 17 and deployed a Known Issue Rollback (KIR). Registry workaround: add EnableHttp2Tls and EnableHttp2Cleartext = 0 under HKLM\System\CurrentControlSet\Services\HTTP\Parameters.
- Windows 10 ESU / Server 2016/2019 MSMQ completely broken after KB5071546/44/43 — inactive queues, IIS HTTP 500s, “Insufficient resources” errors. ACL change on MSMQ storage folder removes write access for service accounts — Intel, AMD, Snapdragon X affected. Fleet admins pausing deployment across tenants HTTP/2
- Windows 10 ESU / Server Clustered MSMQ under load hits simultaneous node failures — failover behavior destabilized
- Windows 11 (all) KB5072033 clean for most users. No major desktop regressions this month
Sources: BleepingComputer: MSMQ bug · Microsoft Q&A · r/sysadmin
Microsoft released out-of-band updates (KB5074974, KB5074978 and related packages) on December 19 to restore MSMQ functionality — available via the Microsoft Update Catalog for manual import into WSUS/SCCM. The fix corrects the NTFS DACL on the MSMQ storage folder. If you’ve already applied the December LCUs, install the OOB update. If you’re not yet patched, Microsoft says the January cumulative will include the correct MSMQ behavior. The PowerShell Invoke-WebRequest issue has a mitigation: add -UseBasicParsing to all automated scripts that fetch web content. Review and audit any scheduled tasks or automation that calls Invoke-WebRequest. Sleep/wake freeze reports settled — the issue was limited to specific hardware configurations, not widespread enough for Microsoft to issue a formal known issue acknowledgement. No OOB updates were needed. The PoC for CVE-2025-62215 published November 20 generated attention but no new confirmed exploitation beyond the original zero-day usage. to consumer devices via Windows Update silently — many users found it fixed on reboot without a manual update. Enterprise admins needed to deploy a specific Group Policy KIR package. The WSUS RCE (CVE-2025-59287) was confirmed exploited in the wild by October 24, Microsoft issued an out-of-band update with a more comprehensive fix. WinRE keyboard/mouse fix arrived via a separate OOB update (KB5070773). Windows 10 end-of-support left a long tail: organizations discovering devices not enrolled in ESU, facing a hard choice between paying Microsoft for extended support or facing zero future patches.
- Windows 10 ESU / Server 2016/2019 MSMQ fix — OOB updates KB5074974/KB5074978 released December 19. Install via Update Catalog or wait for January cumulative
- All platforms CVE-2025-62221 (Cloud Files) actively exploited — ensure CISA KEV deadline (Dec 30) is met
- All PowerShell Audit Invoke-WebRequest usage in all scripts — add -UseBasicParsing as mitigation for CVE-2025-54100
Sources: BleepingComputer · Windows Forum · AskWoody
Resources