Patch Gap

Windows · updated Oct 27, 2026

Windows: a bug fixed in the December 2025 update was used in real attacks

Patched: update nowBeing attacked nowHigh

Last checked · Check before installing; only use the official link.

A bug in the part of Windows that handles cloud files (like OneDrive) lets a program that is already on your PC take full control of it. Microsoft fixed it in the December 2025 Windows update. Any newer monthly update also includes the fix.

Status
Patched: update now
Being attacked?
Yes[2]
Severity
High
Updated

CISA lists this as used in real attacks (added 2025-12-09). Microsoft's Security Update Guide marks it as exploited. Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .

Am I affected?

You are at risk only if your Windows PC has not installed any monthly update since December 2025. Open Settings > Windows Update. If it says 'You're up to date', you are covered.

AppDeviceAffectedFixed in
Windows 10 and 11WindowsWindows 10 and 11 PCs without the December 2025 security update or a newer oneFixed by the December 2025 Windows security update (2025-12-09) or any newer monthly update. Microsoft's page lists the exact update for each Windows version.[1]

How to check your version

These checks only look. They do not change anything on your computer.

Windows 10 and 11 on Windows

Easy way: Start > Settings > Windows Update. Then click Update history to see recent updates.

Or type this in PowerShellRead-only. It only reads the version and changes nothing.

Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn

How to fix it

  1. Open Start > Settings > Windows Update.
  2. Click Check for updates.
  3. Let the updates download and install.
  4. Restart your computer when it asks.

More on each app: Is my Windows up to date?

Official links

Check before installing, and only use these official links or the app's own update button.

For AI agents

This page as data: /incidents/windows-attacked-bugs-dec-2025.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.

Tracking numbers (CVE): CVE-2025-62221

Sources

  1. MakerMicrosoft Security Update Guide: CVE-2025-62221 (December 2025 update) (Dec 9, 2025)
  2. CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-62221 (added 2025-12-09) (Dec 9, 2025)
  3. NVDNVD: CVE-2025-62221 (Dec 9, 2025)

"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.