Microsoft May 2025 Patch Tuesday

By /
  • 101/2025
  • Critical

Microsoft has released its monthly patch of security updates, known as Patch Tuesday. The mentioned patch addressed seven zero-day vulnerabilities.

Microsoft has fixed (78) vulnerabilities, with (5) classified as critical as they could allow the attacker to gain elevated privileges, perform denial of service attacks, obtain sensitive information, bypass security restrictions, or execute arbitrary code and gain access to the affected systems.

May’s Patch Tuesday was released to fix security flaws across several Microsoft products such as Microsoft Excel, Microsoft Office, Visual Studio Code, Windows Kernel, Remote Desktop Gateway Service, Microsoft Defender, Windows Secure Kernel Mode, Windows Hardware Lab Kit, Azure, Azure DevOps, Azure Automation, Microsoft Dataverse, Windows Drivers, Windows Media, Windows Remote Desktop, Windows Kernel and Microsoft Power Apps.

The actively exploited zero-day vulnerabilities in May’s Patch are:

  • Microsoft DWM Core Library Elevation of Privilege Vulnerability “CVE-2025- 30400” allows the authorized attacker to elevate privileges locally.
  • Windows Common Log File System Driver Elevation of Privilege Vulnerability “CVE-2025-32701” allows the authorized attacker to elevate privileges locally.
  • Windows Common Log File System Driver Elevation of Privilege Vulnerability “CVE-2025-32706” allows the authorized attacker to elevate privileges locally.
  • Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability “CVE-2025-32709” allows the authorized attacker to elevate privileges locally.
  • Scripting Engine Memory Corruption Vulnerability “CVE-2025-30397” allows an unauthenticated attacker to gain remote code execution.

The publicly disclosed zero-days are:

  • Microsoft Defender for Identity Spoofing Vulnerability “CVE-2025-26685” allows the unauthorized attacker to perform spoofing over an adjacent network.
  • Visual Studio Remote Code Execution Vulnerability “CVE-2025-32702” allows an unauthorized attacker to execute code locally.

Sample of the addressed vulnerabilities:

1. Azure DevOps Server Elevation of Privilege Vulnerability (CVE-2025-29813):

  • CVSS: 10
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Gain Privilege

2. Microsoft Power Apps Information Disclosure Vulnerability (CVE-2025- 47733):

  • CVSS: 9.1
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Obtain Information
Vulnerabilities

Microsoft MSRC

Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Microsoft MSRC

References

Microsoft MSRC