Microsoft Might 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws

Right this moment is Microsoft’s Might 2025 Patch Tuesday, which incorporates security updates for 72 flaws, together with 5 actively exploited and two publicly disclosed zero-day vulnerabilities.

This Patch Tuesday additionally fixes six “Crucial” vulnerabilities, 5 being distant code execution vulnerabilities and one other an data disclosure bug.

The variety of bugs in every vulnerability class is listed under:

• 17 Elevation of Privilege Vulnerabilities
• 2 Safety Characteristic Bypass Vulnerabilities
• 28 Distant Code Execution Vulnerabilities
• 15 Data Disclosure Vulnerabilities
• 7 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

This depend doesn’t embrace Azure, Dataverse, Mariner, and Microsoft Edge flaws that had been fastened earlier this month.

To study extra concerning the non-security updates launched at the moment, you possibly can evaluate our devoted articles on the Home windows 11 KB5058411 and KB5058405 cumulative updates and the Home windows 10 KB5058379 replace.

5 actively exploited zero-days

This month’s Patch Tuesday fixes one actively exploited zero-day. Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited whereas no official repair is obtainable.

The actively exploited zero-day vulnerability in at the moment’s updates is:

CVE-2025-30400 – Microsoft DWM Core Library Elevation of Privilege Vulnerability

Microsoft fastened an exploited elevation of privileges vulnerability that offers attackers SYSTEM privileges.

“Use after free in Home windows DWM permits a certified attacker to raise privileges regionally,” reads the advisory.

Microsoft attributes the invention of this flaw to the Microsoft Menace Intelligence Middle.

CVE-2025-32701 – Home windows Frequent Log File System Driver Elevation of Privilege Vulnerability

Microsoft fastened an exploited elevation of privileges vulnerability that offers attackers SYSTEM privileges.

“Use after free in Home windows Frequent Log File System Driver permits a certified attacker to raise privileges regionally,” reads the advisory.

Microsoft attributes the invention of this flaw to the Microsoft Menace Intelligence Middle.

CVE-2025-32706 – Home windows Frequent Log File System Driver Elevation of Privilege Vulnerability

Microsoft fastened an exploited elevation of privileges vulnerability that offers attackers SYSTEM privileges.

“Improper enter validation in Home windows Frequent Log File System Driver permits a certified attacker to raise privileges regionally,” explains the advisory.

Microsoft attributes the invention of this flaw to Benoit Sevens of Google Menace Intelligence Group and the CrowdStrike Superior Analysis Crew.

CVE-2025-32709 – Home windows Ancillary Perform Driver for WinSock Elevation of Privilege Vulnerability

Microsoft fastened an exploited elevation of privileges vulnerability that offers attackers SYSTEM privileges.

“Use after free in Home windows Ancillary Perform Driver for WinSock permits a certified attacker to raise privileges regionally,” explains Microsoft’s advisory.

This flaw was disclosed by an “Nameless” researcher.

CVE-2025-30397 – Scripting Engine Reminiscence Corruption Vulnerability

Microsoft fastened a distant code execution vulnerability that may be exploited by means of Microsoft Edge or Web Explorer.

“Entry of useful resource utilizing incompatible sort (‘sort confusion’) in Microsoft Scripting Engine permits an unauthorized attacker to execute code over a community,” explains Microsoft.

Microsoft says that risk actors have to trick an authenticated consumer into clicking on a specifically crafted hyperlink in Edge or Web Explorer, permitting an unauthenticated attacker to realize distant code execution.

Microsoft attributes the invention of this flaw to the Microsoft Menace Intelligence Middle.

Microsoft has not shared any particulars on how these flaws had been exploited in assaults.

The publicly disclosed zero-days are:

CVE-2025-26685 – Microsoft Defender for Identification Spoofing Vulnerability

Microsoft fixes a flaw in Microsoft Defender that enables an unauthenticated assault to spoof one other account.

“Improper authentication in Microsoft Defender for Identification permits an unauthorized attacker to carry out spoofing over an adjoining community,” explains Microsoft.

The flaw could be exploited by an unauthenticated attacker with LAN entry.

Microsoft attributes the invention of this flaw to Joshua Murrell with NetSPI.

CVE-2025-32702 – Visible Studio Distant Code Execution Vulnerability

Microsoft fastened a Visible Studio distant code execution flaw that may be exploited by an unauthenticated attacker.

“Improper neutralization of particular components utilized in a command (‘command injection’) in Visible Studio permits an unauthorized attacker to execute code regionally,” explains Microsoft.

Microsoft has not shared who disclosed this flaw.

Current updates from different firms

Different distributors who launched updates or advisories in Might 2025 embrace:

The Might 2025 Patch Tuesday Safety Updates

Under is the whole listing of resolved vulnerabilities within the Might 2025 Patch Tuesday updates.

To entry the complete description of every vulnerability and the programs it impacts, you possibly can view the full report right here.