Microsoft Patch Tuesday October 2025: 6 Zero Days and 172 Flaws

As we know, every second Tuesday of the month, Microsoft releases security patches for its products. This cycle, known as Patch Tuesday, is key to keeping systems protected against new threats. And the October 2025 bulletin was no exception: Microsoft released no fewer than 172 updates, including six zero-day vulnerabilities, two of which are already being actively exploited in real-world attacks.

This volume of patches reflects the constant growth of the threat landscape, with critical flaws affecting everything from Office applications to the core of the Windows operating system. Among the most severe issues are remote code execution (RCE) vulnerabilities and privilege escalation bugs — both highly sought after by cybercriminals to compromise systems.

In addition, these updates arrive at an important time: many organizations are in the midst of the Windows 10 end-of-support transition, making timely patching more critical than ever to prevent breaches — especially amid increasingly sophisticated threats from ransomware groups and state-sponsored attackers.

Overall, the fixes cover a wide range of Microsoft products, including Windows, Microsoft Office, Azure, Exchange Server, and more.

At TecnetOne, we want you to stay informed about these updates and best cybersecurity practices. That’s why we recommend regularly reviewing the security bulletins on our TecnetBlog, applying patches as soon as possible, and maintaining a proactive protection strategy. Prevention remains the best defense.

Six Zero-Day Vulnerabilities Take the Spotlight in Microsoft’s October 2025 Patch Tuesday

As a reminder, a zero-day vulnerability is any flaw that has been publicly disclosed or actively exploited before an official patch is available. In this cycle, Microsoft addressed several of these critical vulnerabilities affecting Windows, SQL Server, TPM 2.0, and even third-party operating systems like IGEL OS.

1. CVE-2025-24990 – Privilege Escalation via Agere Modem Driver

One of the most notable actively exploited vulnerabilities, CVE-2025-24990, impacts the Agere modem driver natively included in supported versions of Windows.

Microsoft confirmed that attackers were using this driver to gain administrative privileges, prompting the company to remove it entirely as part of this update. The affected file, ltmdm64.sys, will no longer be present after installing the October patch.

However, Microsoft warns that this change will also render fax modems that depend on the driver inoperative.

2. CVE-2025-59230 – Privilege Escalation in Windows Remote Access Connection Manager

Another actively exploited zero-day is CVE-2025-59230, a flaw in the Windows Remote Access Connection Manager that allows a local attacker to escalate privileges to SYSTEM, the highest level in Windows.

Microsoft explained that this is caused by improper access control, and although it’s not trivial to exploit, it requires significant technical preparation by the attacker.

3. CVE-2025-47827 – Secure Boot Bypass in IGEL OS < v11

Although not a Microsoft product, the company included a fix for IGEL OS, a system used in corporate environments and thin clients.

CVE-2025-47827 allows attackers to bypass Secure Boot due to incorrect verification of cryptographic signatures in the igel-flash-driver module. This enables mounting of root file systems from malicious, unsigned images, paving the way for persistent malware installation.

Publicly Disclosed (but Not Necessarily Exploited) Zero-Days

Microsoft also acknowledged three additional zero-day vulnerabilities that were publicly disclosed, though not all have been confirmed as actively exploited at the time of patch release.

4. CVE-2025-0033 – Vulnerability in AMD EPYC Processors (SEV-SNP)

This issue, attributed to AMD, affects servers using SEV-SNP (Secure Encrypted Virtualization – Secure Nested Paging). The flaw lies in the initialization of the Reverse Map Table (RMP) and could allow a malicious hypervisor to tamper with a virtual machine’s protected memory.

While the risk of plaintext data exposure is low, it poses a significant threat to memory integrity in virtualized environments. Microsoft is still developing patches for Azure Confidential Computing clusters based on AMD processors and will notify affected customers through Azure Service Health once available.

5. CVE-2025-24052 – Second Flaw in the Agere Modem Driver

Closely related to CVE-2025-24990, CVE-2025-24052 also affects the Agere modem driver and was publicly disclosed.

Microsoft highlights that this flaw can be exploited even if the modem is inactive or unused, extending the risk to virtually all supported versions of Windows.

6. CVE-2025-2884 – Out-of-Bounds Read in TCG TPM 2.0

Lastly, a vulnerability was fixed in the reference implementation of Trusted Platform Module (TPM) 2.0, widely used in modern systems to protect boot integrity and system trust.

CVE-2025-2884 resides in the CryptHmacSign function and stems from incomplete validation of signature algorithms. It could lead to an out-of-bounds read, resulting in information disclosure or potentially causing a denial of service in the TPM module.

Read more: What is Third-Party Patch Management?

October 2025 Patch Tuesday Security Updates

Below is a summary by category, highlighting the most affected products and the most critical types of vulnerabilities.

Note: This table only summarizes the most notable vulnerabilities. The full bulletin includes over 100 CVEs related to Windows, Office, Azure, Edge, Visual Studio, and third-party hardware. For complete technical details, we recommend checking Microsoft’s official Security Update Guide.

Why Does This Matter?

The presence of six zero-day vulnerabilities in a single bulletin highlights how urgent it is to apply these updates immediately. Some of these flaws are already being actively exploited, while others—though not yet observed in attacks—are publicly disclosed and could soon become the focus of new threat campaigns.

Moreover, these vulnerabilities span multiple environments: they affect on-premises infrastructure (such as Windows, SQL Server, and Exchange Server), cloud and virtualized systems (including Azure and IGEL OS), and even hardware platforms like AMD processors with SEV-SNP technology. This means organizations of every type—traditional, hybrid, or fully cloud-based—are potentially at risk.

From local privilege escalations and Secure Boot bypasses to memory-protection failures, the profile of these vulnerabilities reflects the increasing sophistication and diversity of today’s threat landscape.

TecnetOne's Recommendation: Applying security patches as soon as possible remains one of the most effective ways to defend systems against targeted attacks, malware, ransomware, and data breaches.
Neglecting updates leaves the door open to threats that are already scanning for exploitable weaknesses.

Keeping your systems fully updated is not just routine maintenance—it’s a foundational practice for any robust cybersecurity strategy.