The Update BureauKB5071417: Cumulative update for Windows 11, version 23H2, December 2025. Closes exploited Cloud Files flaw; adds a PowerShell warning
In short
The update fixes 30 Important vulnerabilities, including an exploited Cloud Files driver flaw. PowerShell 5.1 now warns before running scripts from web content.
Does it affect you? Applies to: Devices running Windows 11, version 23H2. The end-of-updates date applies to Enterprise and Education editions.
What changes
Improvements 2 changes
PowerShell 5.1
For: People using PowerShell 5.1
-
Invoke-WebRequestnow shows a security warning before processing web content that could run scripts. You can continue or cancel.1The prompt addresses the script-execution risk associated with CVE-2025-54100.
Servicing stack
For: Devices receiving the update
-
The component that installs Windows updates receives quality improvements.2
The package includes servicing stack update KB5071963, build 22621.6265.
Fix 1 change
Windows security
- Windows receives fixes for security issues.3
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-12-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5070312, KB5068865, KB5067112, KB5066793
+44 earlier
KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123 - Replaced by
- KB5073455
| Version | Build | Channel |
|---|---|---|
| 23H2 | 22631.6345 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2025-62221
Exploited
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
|
Important | 8.8 |
|
PowerShell Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Win32k Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Client-Side Caching Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Projected File System Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Common Log File System Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Installer Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Shell Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows Storage VSP Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Windows File Explorer Elevation of Privilege Vulnerability
|
Important | 7.5 |
|
Windows File Explorer Elevation of Privilege Vulnerability
|
Important | 7.3 |
|
DirectX Graphics Kernel Elevation of Privilege Vulnerability
|
Important | 7.0 |
|
DirectX Graphics Kernel Denial of Service Vulnerability
|
Important | 6.5 |
|
DirectX Graphics Kernel Denial of Service Vulnerability
|
Important | 6.5 |
|
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
|
Important | 6.5 |
|
Windows DirectX Information Disclosure Vulnerability
|
Important | 6.5 |
|
Windows Defender Firewall Service Information Disclosure Vulnerability
|
Important | 5.5 |
|
Windows Hyper-V Denial of Service Vulnerability
|
Important | 5.3 |
Downloads (Microsoft Update Catalog)
x64
23H2
915.1 MB
Arm64
23H2
1.0 GB
Updated components
710 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Graphics and display | 15 |
| File Explorer and shell | 13 |
| Hyper-V and virtualization | 10 |
| Kernel | 6 |
| Remote Desktop | 4 |
| Secure Boot | 4 |
| Settings | 4 |
| Search | 3 |
| Security and sign-in | 3 |
| Storage and file systems | 3 |
| Bluetooth | 2 |
| Emoji and input | 1 |
Sources
Updated
Cited passages from Microsoft's official notes (3)
-
1.
[PowerShell 5.1] Invoke-WebRequest now includes a confirmation prompt with a security warning of script execution risk. You can choose to continue or cancel the request.
support.microsoft.com -
2.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
3.
This update addresses security issues for your Windows operating system.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake