Microsoft Might 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws

At present is Microsoft’s Might 2025 Patch Tuesday, which incorporates safety updates for 72 flaws, together with 5 actively exploited and two publicly disclosed zero-day vulnerabilities.

This Patch Tuesday additionally fixes six “Important” vulnerabilities, 5 being distant code execution vulnerabilities and one other an info disclosure bug.

The variety of bugs in every vulnerability class is listed under:

• 17 Elevation of Privilege Vulnerabilities
• 2 Safety Function Bypass Vulnerabilities
• 28 Distant Code Execution Vulnerabilities
• 15 Info Disclosure Vulnerabilities
• 7 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

This rely doesn’t embody Azure, Dataverse, Mariner, and Microsoft Edge flaws that have been mounted earlier this month.

To study extra in regards to the non-security updates launched right this moment, you possibly can assessment our devoted articles on the Home windows 11 KB5058411 and KB5058405 cumulative updates and the Home windows 10 KB5058379 replace.

5 actively exploited zero-days

This month’s Patch Tuesday fixes one actively exploited zero-day. Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited whereas no official repair is accessible.

The actively exploited zero-day vulnerability in right this moment’s updates is:

CVE-2025-30400 – Microsoft DWM Core Library Elevation of Privilege Vulnerability

Microsoft mounted an exploited elevation of privileges vulnerability that provides attackers SYSTEM privileges.

“Use after free in Home windows DWM permits a licensed attacker to raise privileges domestically,” reads the advisory.

Microsoft attributes the invention of this flaw to the Microsoft Risk Intelligence Middle.

CVE-2025-32701 – Home windows Frequent Log File System Driver Elevation of Privilege Vulnerability

Microsoft mounted an exploited elevation of privileges vulnerability that provides attackers SYSTEM privileges.

“Use after free in Home windows Frequent Log File System Driver permits a licensed attacker to raise privileges domestically,” reads the advisory.

Microsoft attributes the invention of this flaw to the Microsoft Risk Intelligence Middle.

CVE-2025-32706 – Home windows Frequent Log File System Driver Elevation of Privilege Vulnerability

Microsoft mounted an exploited elevation of privileges vulnerability that provides attackers SYSTEM privileges.

“Improper enter validation in Home windows Frequent Log File System Driver permits a licensed attacker to raise privileges domestically,” explains the advisory.

Microsoft attributes the invention of this flaw to Benoit Sevens of Google Risk Intelligence Group and the CrowdStrike Superior Analysis Workforce.

CVE-2025-32709 – Home windows Ancillary Perform Driver for WinSock Elevation of Privilege Vulnerability

Microsoft mounted an exploited elevation of privileges vulnerability that provides attackers SYSTEM privileges.

“Use after free in Home windows Ancillary Perform Driver for WinSock permits a licensed attacker to raise privileges domestically,” explains Microsoft’s advisory.

This flaw was disclosed by an “Nameless” researcher.

CVE-2025-30397 – Scripting Engine Reminiscence Corruption Vulnerability

Microsoft mounted a distant code execution vulnerability that may be exploited via Microsoft Edge or Web Explorer.

“Entry of useful resource utilizing incompatible kind (‘kind confusion’) in Microsoft Scripting Engine permits an unauthorized attacker to execute code over a community,” explains Microsoft.

Microsoft says that risk actors must trick an authenticated consumer into clicking on a specifically crafted hyperlink in Edge or Web Explorer, permitting an unauthenticated attacker to realize distant code execution.

Microsoft attributes the invention of this flaw to the Microsoft Risk Intelligence Middle.

Microsoft has not shared any particulars on how these flaws have been exploited in assaults.

The publicly disclosed zero-days are:

CVE-2025-26685 – Microsoft Defender for Id Spoofing Vulnerability

Microsoft fixes a flaw in Microsoft Defender that enables an unauthenticated assault to spoof one other account.

“Improper authentication in Microsoft Defender for Id permits an unauthorized attacker to carry out spoofing over an adjoining community,” explains Microsoft.

The flaw will be exploited by an unauthenticated attacker with LAN entry.

Microsoft attributes the invention of this flaw to Joshua Murrell with NetSPI.

CVE-2025-32702 – Visible Studio Distant Code Execution Vulnerability

Microsoft mounted a Visible Studio distant code execution flaw that may be exploited by an unauthenticated attacker.

“Improper neutralization of particular parts utilized in a command (‘command injection’) in Visible Studio permits an unauthorized attacker to execute code domestically,” explains Microsoft.

Microsoft has not shared who disclosed this flaw.

Current updates from different corporations

Different distributors who launched updates or advisories in Might 2025 embody:

The Might 2025 Patch Tuesday Safety Updates

Under is the whole checklist of resolved vulnerabilities within the Might 2025 Patch Tuesday updates.

To entry the total description of every vulnerability and the techniques it impacts, you possibly can view the full report right here.

Based mostly on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK strategies behind 93% of assaults and easy methods to defend in opposition to them.

Learn the Pink Report 2025