The Update BureauKB5072033: Cumulative update for Windows 11, versions 24H2 and 25H2, December 2025. Cloud Files driver flaw under attack; File Explorer flash fixed
An actively exploited Cloud Files driver flaw is addressed, and File Explorer’s brief white flash is fixed. The update also includes fixes for virtual switches and other issues.
Does it affect you? Applies to: Devices running Windows 11, version 25H2 or 24H2, on x64 or Arm64 systems.
Review notes Additional details from the official release notes (2) Read notes
- What changes Microsoft updated the second MSU file listed under Catalog, Method 2.
- In detail Microsoft says its standardized update titles remove unnecessary technical elements such as platform architecture while retaining the date, KB number, and build or version.
The official sources are linked at the end of the page.
Microsoft publishes separate notes for this KB for Windows Server.
What changes
Improvements 4 changes
PowerShell 5.1
For: PowerShell 5.1 users
-
A warning now asks before web content can run a script through PowerShell.1
Invoke-WebRequestnow displays a confirmation prompt warning about the risk of script execution. You can continue or cancel.
System Components
-
Some isolated situations should be more reliable because a Windows service now starts automatically.2
The AppX Deployment Service (
Appxsvc) has moved to Automatic startup type.
AI Components
For: Copilot+ PC users
-
AI components are updated on Copilot+ PCs.3
Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2511.1224.0. These components apply only to Copilot+ PCs.
Servicing stack
-
The component that installs Windows updates receives quality improvements.4
The combined update includes servicing stack update KB5071142, build 26100.7295.
Fixes 3 changes
Copilot
-
Click to Do now appears in front when you share data with Copilot.5
Addresses the issue where Ask Copilot did not activate the Click to Do window as expected.
File Explorer (known issue)
-
File Explorer no longer briefly flashes white when you move between pages.6
Addresses an issue that might occur after installing KB5070311.
Networking
-
Virtual machines keep network access after a host restarts instead of losing their connection.7
Fixes external virtual switches losing their physical network adapter (NIC) bindings after a host restart and reverting to internal mode.
Known issues
-
Password icon might be missing or invisible in the lock screen sign-in options
Microsoft lists a lock screen issue where the password icon might be missing. The password button is still available in the blank space; this mainly affects managed or enterprise devices.8
How to apply the workaround WorkaroundSelect the blank space where the password icon should appear to open the password box.8
-
Mirror networking on Windows Subsystem for Linux might fail
Microsoft lists an issue where mirrored networking in Windows Subsystem for Linux might fail with some third-party VPNs. It can block access to work resources, while Windows itself can still reach them.9
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
-
RemoteApp sessions might fail to start on Azure Virtual Desktop
Microsoft lists an issue where RemoteApp connections might fail in Azure Virtual Desktop. Full desktop sessions are not affected; the issue mainly concerns enterprise environments.10
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-12-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5070311, KB5068861, KB5067036, KB5070773
+37 earlier
KB5066835, KB5065789, KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239 - Replaced by
- KB5074109
| Version | Build | Channel |
|---|---|---|
| 24H2 | 26100.7462 | General availability |
| 25H2 | 26200.7462 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2025-62221
Exploited
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
PowerShell Remote Code Execution Vulnerability
|
Important | 7.8 |
The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
1,856 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Settings | 28 |
| File Explorer and shell | 21 |
| Graphics and display | 15 |
| Hyper-V and virtualization | 10 |
| Networking | 8 |
| Remote Desktop | 8 |
| Kernel | 5 |
| Security and sign-in | 5 |
| Printing | 4 |
| Secure Boot | 4 |
| Storage and file systems | 4 |
| Bluetooth | 3 |
Verified in package: changed files confirm AI Components, Networking.
Sources
Cited passages from Microsoft's official notes (10)
-
1.
[PowerShell 5.1] Invoke-WebRequest now includes a confirmation prompt with a security warning of script execution risk. You can choose to continue or cancel the request.
support.microsoft.com -
2.
[System Components] The AppX Deployment Service (Appxsvc) has moved to Automatic startup type to improve reliability in some isolated scenarios.
support.microsoft.com -
3.
Image Search 1.2511.1224.0 Content Extraction 1.2511.1224.0 Semantic Analysis 1.2511.1224.0 Settings Model 1.2511.1224.0
support.microsoft.com -
4.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
5.
[Copilot] Fixed: This update addresses an issue where Ask Copilot didn’t activate the Click to Do window as expected. The window now appears in the foreground when you share data with Copilot.
support.microsoft.com -
6.
[File Explorer (known issue)] Fixed: This update addresses an issue where File Explorer briefly flashes white when you navigate between pages.
support.microsoft.com -
7.
[Networking] Fixed: This update fixes an issue where external virtual switches lose their physical network adapter (NIC) bindings after a host restart.
support.microsoft.com -
8.
After installing the August 2025 non-security preview update (KB5064081) or later updates, you might notice that the password icon is not visible in the sign-in options on the lock screen.
support.microsoft.com -
9.
After installing the October 2025 Windows non-security update (KB5067036), released on October 28, 2025, or a later update, mirrored networking mode in Windows Subsystem for Linux (WSL) might cause issues with some third-party VPNs.
support.microsoft.com -
10.
After installing the November 2025 Windows non-security update (KB5070311) or later updates, you might experience RemoteApp connection failures in Azure Virtual Desktop (AVD) environments. Full desktop sessions aren’t affected.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 3/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake