{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "windows-attacked-bugs-dec-2025",
  "url": "https://patchgap.ai/incidents/windows-attacked-bugs-dec-2025/",
  "path": "/incidents/windows-attacked-bugs-dec-2025/",
  "json_url": "https://patchgap.ai/incidents/windows-attacked-bugs-dec-2025.json",
  "title": "Windows: a bug fixed in the December 2025 update was used in real attacks",
  "category": "windows",
  "platforms": [
   "windows"
  ],
  "products": [
   "windows"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "CISA lists this as used in real attacks (added 2025-12-09). Microsoft's Security Update Guide marks it as exploited.",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2025-12-09",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2025-62221"
  ],
  "summary": "A bug in the part of Windows that handles cloud files (like OneDrive) lets a program that is already on your PC take full control of it. Microsoft fixed it in the December 2025 Windows update. Any newer monthly update also includes the fix.",
  "am_i_affected": "You are at risk only if your Windows PC has not installed any monthly update since December 2025. Open Settings > Windows Update. If it says 'You're up to date', you are covered.",
  "action": "Run Windows Update (December 2025 update or newer)",
  "affected": [
   {
    "product": "windows",
    "product_name": "Windows 10 and 11",
    "platform": "windows",
    "affected_versions": "Windows 10 and 11 PCs without the December 2025 security update or a newer one",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Fixed by the December 2025 Windows security update (2025-12-09) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.",
    "fixed_source_urls": [
     "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221"
    ],
    "check": {
     "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
     "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   }
  ],
  "fix_steps": [
   "Open Start > Settings > Windows Update.",
   "Click Check for updates.",
   "Let the updates download and install.",
   "Restart your computer when it asks."
  ],
  "official_patch_links": [
   {
    "label": "Microsoft: how to update Windows",
    "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   },
   {
    "label": "Microsoft: CVE-2025-62221 details",
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221",
    "title": "Microsoft Security Update Guide: CVE-2025-62221 (December 2025 update)",
    "date": "2025-12-09",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-62221 (added 2025-12-09)",
    "date": "2025-12-09",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62221",
    "title": "NVD: CVE-2025-62221",
    "date": "2025-12-09",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}