With just 72 Common Vulnerabilities and Exposures (CVEs) to address this month, it’s far from the smallest December patch drop on record, but it’s also not the nightmare before Christmas we’ve seen in the past.

Fortra Associate Director of Security R&D Tyler Reguly said cybersecurity professionals must be on Santa’s nice list, or at least, Microsoft’s.”

Among the December CVEs, the spotlight naturally falls on CVE-2024-49138, a vulnerability in the Windows Common Log File System (CLFS). If CLFS sounds familiar, it’s the patching equivalent of a perennial holiday rerun. This marks the eighth CLFS vulnerability addressed this year—a modest improvement over the 12 patched in 2022 and the 10 in 2023.

True to form, this vulnerability is another elevation of privilege exploit. A successful attacker could gain SYSTEM-level permissions, which is undoubtedly alarming, but at this point, CLFS might as well be part of the December Patch Tuesday tradition.

The month’s most severe vulnerability by score is CVE-2024-49112, which clocks in at a CVSS 9.8. This LDAP-related vulnerability could allow remote, unauthenticated code execution.

Microsoft’s mitigations amount to little more than good security hygiene—keep your domain controllers off the internet or block inbound RPC from untrusted networks. In other words, a gentle nudge to do what you should already be doing if you’re following best practices like the DISA STIG for Active Directory Domains.

As the year approaches, the numbers tell a story of Microsoft’s patching rhythm: 1,088 vulnerabilities resolved in 2024, a figure that’s eerily close to 1,063 from 2023 and 1,119 from 2022.

Vole has signed CISA’s Secure by Design pledge; perhaps future Patch Tuesdays will bring fewer CVEs and more robust software. But for now, as Tyler Reguly notes, “While it would be nice to see the number of vulnerabilities each year decreasing, at least consistency lets us know what to expect.”

As cybersecurity teams settle in for the holidays, they can breathe a small sigh of relief—this December isn’t the stocking full of coal it could have been. However, one wonders if Microsoft’s consistent patching numbers are less a sign of steady quality and more a symptom of an unrelenting software ecosystem that always leaves something to be fixed.

For now, cybersecurity professionals can enjoy their spiked eggnog, secure in the knowledge that, for once, the end-of-year scramble won’t ruin their festive season.