CVE-2025-62221

ENISA EUVD: EUVD-2025-202200 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 5 articles Published: 2025-12-09

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

2.23%

probability

This CVE has a 2.23% probability of being exploited in the next 30 days.

0% Top 84.7th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

7.8

HIGH

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Unproven

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Description

NVD

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Affected Products

Microsoft

Windows 10 Version 1809

10.0.17763.0

Microsoft

Windows 10 Version 21H2

10.0.19044.0

Microsoft

Windows 10 Version 22H2

10.0.19045.0

Microsoft

Windows 11 version 22H3

10.0.22631.0

Microsoft

Windows 11 Version 23H2

10.0.22631.0

microsoft

windows 10 1809

microsoft

windows 10 21h2

microsoft

windows 10 22h2

microsoft

windows 11 23h2

microsoft

windows 11 24h2

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.8146

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

10.0.25398.0 <10.0.25398.2025

Microsoft

Windows 11 Version 23H2

10.0.22631.0 <10.0.22631.6345

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.4529

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.8146

Microsoft

Windows 11 version 22H3

10.0.22631.0 <10.0.22631.6345

Microsoft

Windows Server 2025

10.0.26100.0 <10.0.26100.7462

Microsoft

Windows 11 Version 24H2

10.0.26100.0 <10.0.26100.7462

Microsoft

Windows 10 Version 22H2

10.0.19045.0 <10.0.19045.6691

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.8146

Microsoft

Windows Server 2025 (Server Core installation)

10.0.26100.0 <10.0.26100.7462

Microsoft

Windows 11 Version 25H2

10.0.26200.0 <10.0.26200.7462

Microsoft

Windows 10 Version 21H2

10.0.19044.0 <10.0.19044.6691

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-416 · Use After Free CWE-664 · Improper Control of a Resource Through its Lifetime CWE-666 · Operation on Resource in Wrong Phase of Lifetime CWE-672 · Operation on a Resource after Expiration or Release CWE-825 · Expired Pointer Dereference

Google Project Zero

Patched

Dec. 9, 2025

Reported by

Microsoft Threat Intelligence Center (MSTIC) & Microsoft Security Response Center (MSRC)

Root Cause Analysis

???

Exploits & PoC

Teodor1231241/DEMO-Proof-of-Concept-Temporal-Memory-Inconsistency-in-cldflt.sys-CVE-2025-62221

1 2026-01-18

1 repo — triés par ⭐ Rechercher sur GitHub ↗

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221

vendor-advisory patch

Signal Intelligence

Confidenceⓘ

92%

EPSS 2.23%

CVSS v3.1 7.8

Mentions 5

Last Seen May 18, 2026

CNA Information

CNA Assigner

microsoft

CNA Title

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Analyst Note

CVE-2025-62221 is confirmed as a legitimate Windows privilege escalation vulnerability affecting Cloud Files Mini Filter Driver, corroborated by official Microsoft Security Response Center documentation and multiple reputable security news sources (TheHackerNews, BleepingComputer) covering the December 2025 Patch Tuesday release. The vulnerability's inclusion in Google Project Zero and its HIGH CVSS score (7.8) further validate its authenticity and significance.