December 2025 Third-Party Vulnerabilities and Patches 

December showed a slight uptick compared to November. We recorded 89 unique vulnerabilities, up from 81 last month, and remediation efforts resulted in 74 patches. Interestingly, the number of vulnerable applications climbed to 50, reversing November’s sharp drop to 37. While activity didn’t reach October’s peak, December marked a modest rebound in both vulnerabilities and affected applications. 

Notable vulnerabilities in December 2025 third-party patches 

There are four vulnerabilities with known exploits: CVE-2025-14174, CVE-2025-55182, CVE-2025-14847 and CVE-2025-13223. All are listed in CISA’s Known Exploited Vulnerabilities Catalog.  

First, React2Shell (CVE-2025-55182) is a critical vulnerability in the React Server Components (RSC) “Flight” protocol that impacts applications using RSC. An unauthenticated attacker can send a crafted HTTP request to execute code remotely. Any organization using RSC or frameworks that include RSC features such as Next.js, React Router in RSC mode, Waku, @parcel/rsc, @vitejs/plugin-rsc, or rwsdk is at risk. CVSS for vulnerability is at its maximum of 10, and its EPSS 0.505 is quite elevated. Remediation of this vulnerability should be the topmost priority for organizations. Multiple sources have further information on the topic of this vulnerability: 

• NIST 
• AWS Security Blog 
• React Blog 
  

CVE-2025-14174 is an out-of-bounds memory access vulnerability in ANGLE (Almost Native Graphics Layer Engine) used by Google Chrome and other Chromium-based browsers. It has an 8.1 CVSS so it can be considered high severity with its impact abilities. And since it is an actively exploited vulnerability, it should be patched urgently. More information can be found in Google Releases and Edge release notes. 

CVE-2025-13223 is once again a confusion vulnerability in V8 JavaScript and WebAssembly engine. If you wish to read more about Chromium V8 engine vulnerabilities, please check out my blog from November 2025. As I mentioned, this vulnerability is actively exploited in the wild, meaning it requires your immediate attention. Check Google Releases and CISA for more information. 

CVE-2025-14847, also known as MongoBleed, allows an unauthenticated attacker to read uninitialized heap memory by sending malformed compressed packets. The CVSS base score for vulnerability is 8.7. EPSS is well elevated at 0.68. There are over 87,000 vulnerable MongoDB instances identified globally, and a proof-of-concept exploit exists. This vulnerability should be remediated as soon as possible. More information can be found on MongoDB.org and CISA. 

Browser security updates in December 2025 

Major browsers, including Google Chrome, Microsoft Edge, Brave, Mozilla Firefox (including ESR versions), Opera One, Vivaldi, and others received numerous security updates addressing various vulnerabilities.  

Microsoft product updates included in December 2025 third-party patches 

In addition to Edge, Microsoft issued security updates for several other products: 

• Microsoft 365 Apps 
• Microsoft Edge for Business 
• Microsoft Visio 
• Microsoft Project 
• Microsoft Edge Beta 

Detailed list of December 2025 third-party patches 

For a complete list of applications, versions, and the number of remediated vulnerabilities, see the table below generated using Application Workspace data. 

Application management at the speed of your operations 

Vulnerabilities move fast, especially in a distributed workforce. Discover how Application Workspace helps IT teams keep applications patched, compliant, and correctly configured, wherever work happens.