Patch Tuesday July 2025: Microsoft Fixes 137 Vulnerabilities

Today is Patch Tuesday for July 2025, and as it does every month, Microsoft has released new security updates, this time to fix 137 different bugs, including a zero-day vulnerability that was already public and affected Microsoft SQL Server.

In addition, this update package includes 14 flaws classified as “critical.” Ten of them allow an attacker to remotely execute malicious code, one exposes sensitive information, and two others are related to vulnerabilities in AMD processors that could be used to spy on what is happening on your computer.

In summary, this is what Microsoft has fixed this month:

1. 53 privilege escalation flaws (when someone without permissions can take control of the system)

2. 8 flaws that allow security features to be bypassed

3. 41 remote code execution errors (among the most dangerous)

4. 18 information leakage vulnerabilities

5. 6 flaws that can cause system crashes or freezes

6. 4 impersonation vulnerabilities

And that's not all: these figures do not include four fixes in Mariner (Microsoft's container system) or three security patches for Microsoft Edge that were already released earlier this month.

A zero-day in SQL Server and critical flaws in Microsoft Office

This Patch Tuesday came with some important fixes, including a zero-day that was already public and affected Microsoft SQL Server. In this case, the vulnerability in question is:

CVE-2025-49719 – Information leak in Microsoft SQL Server

This flaw could allow a remote attacker (without needing to log in or have access to the system) to obtain sensitive data from the server's memory. In Microsoft's words, the problem is due to poor input validation in SQL Server, which opens the door to information leaks over the network.

To fix it, administrators must update to the latest version of Microsoft SQL Server and ensure that OLE DB driver 18 or 19 is installed.

The discovery of this flaw was credited to Vladimir Aleksic, a Microsoft researcher, although no details have been shared about how it was made public.

Read more: What is Third-Party Patch Management?

Security Updates for this Microsoft Patch Tuesday July 2025

Here is the complete list of bugs that Microsoft fixed with Tuesday's security updates, corresponding to July 2025.

Conclusion: Update today and protect yourself

Patch Tuesday in July 2025 stands out for the significant number of bugs fixed (137 in total) and, above all, for the presence of a zero-day vulnerability that was already being exploited by attackers.

Updating your operating system and applications is the most effective and easiest way to prevent cyberattacks. Whether you are an individual user or a business network administrator, don't miss out on these updates.

Cybersecurity is not just for experts: we all have a responsibility to keep our devices protected. And applying the July 2025 Patch Tuesday patches is the first step.