CVE-2025-62221: Windows Cloud Files Mini Filter Driver use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8 with confirmed in-the-wild exploitation per CISA KEV and a near-term remediation deadline, but it requires local low-privilege access rather than being remotely reachable.

What it is

The Windows Cloud Files Mini Filter Driver contains a use-after-free (CWE-416) that lets an authorized local attacker elevate privileges. Microsoft rates it CVSS 3.1 7.8 (HIGH), and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-12-09, so it is being exploited in the wild.

Impact

A local attacker with existing low-privilege access gains full compromise of confidentiality, integrity and availability (C:H/I:H/A:H), typically escalating to SYSTEM. This enables credential theft, disabling of defenses and lateral movement on the host.

Attack surface

Reached locally (AV:L) with low privileges required (PR:L) and no user interaction (UI:N); the attacker must already have code execution or an interactive session on the target Windows host. No remote or network vector is described.

Exploitation

CISA KEV lists it as exploited with a remediation due date of 2025-12-30, though no ransomware campaign use is recorded. EPSS is 0.02505 (83.9th percentile), indicating elevated but not top-tier predicted activity.

What to do

• Apply the Microsoft security update for CVE-2025-62221 across all listed Windows 10, Windows 11 and Windows Server builds as the first action.
• Follow CISA BOD 22-01 guidance and meet the 2025-12-30 remediation deadline; discontinue use of affected products if no mitigation is available.
• Restrict and monitor local interactive and low-privilege execution paths on endpoints and servers to reduce the pool of accounts that can trigger the driver.
• Enforce least privilege and remove unnecessary local admin or interactive logon rights from non-administrative users.
• Track vendor advisories for any updated mitigation guidance if patching cannot be completed immediately.

Detection

• Monitor for unexpected elevation to SYSTEM or high-integrity tokens originating from processes interacting with the Cloud Files mini filter driver.
• Hunt for crashes or abnormal terminations in cloud files filter driver components that may indicate use-after-free triggering.
• Correlate local low-privilege process activity with subsequent privileged operations or new service creation on patched and unpatched hosts.
• Review endpoint telemetry for known post-exploitation behavior following local privilege escalation, such as credential dumping or defense evasion.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.