Patch Tuesday May 2025: Microsoft Fixes 72 Vulnerabilities

Today is May 2025 Patch Tuesday, and as on every second Tuesday of the month, Microsoft has released its batch of security updates. This time it comes with a significant number of fixes: 72 vulnerabilities were addressed, including five that were already being actively exploited and two zero-day vulnerabilities that had already been publicly disclosed.

Among the fixes, six vulnerabilities stand out as classified “critical”—five of which allow remote code execution (one of the most severe types) and one related to the exposure of sensitive information. Here’s a breakdown of the patched issues by type:

1. 17 elevation of privilege

2. 2 security feature bypass

3. 28 remote code execution

4. 15 information disclosure

5. 7 denial of service

6. 2 spoofing

Important: This list does not include previously addressed issues this month in Azure, Dataverse, Mariner, or Microsoft Edge, which were resolved in earlier updates.

In summary, if you use Microsoft products—especially Windows—don’t skip this round of updates. It's one of the most significant of the year so far

Five Zero-Day Vulnerabilities Were Already Being Exploited

In the May 2025 Patch Tuesday, Microsoft addressed five security flaws that were already being exploited by attackers. These are known as zero-day vulnerabilities—bugs that were either publicly known or being actively abused before a fix was available. This is significant because it means cybercriminals were leveraging these flaws to target systems before an official patch existed.

1. CVE-2025-30400 – Privilege Escalation in Microsoft DWM

This vulnerability affects the DWM (Desktop Window Manager) library, a core component of Windows' graphical system. It allowed an attacker with limited access to elevate privileges and gain full control of the system (SYSTEM-level access).

The flaw is tied to a classic technique: a use-after-free condition. In simple terms, Windows attempted to use a resource after it had already been freed, creating an opportunity for malicious exploitation. This vulnerability was discovered by the Microsoft Threat Intelligence Center.

2. CVE-2025-32701 – Privilege Escalation in the Common Log File System

Microsoft fixed a serious vulnerability that was being actively exploited, allowing attackers with limited access to achieve full SYSTEM-level control.

According to Microsoft, the issue lay in the Windows Common Log File System (CLFS) driver and involved the same use-after-free bug. Windows tried to access a memory resource that had already been released, making the system vulnerable. This vulnerability was also discovered by Microsoft’s Threat Intelligence Center.

3. CVE-2025-32706 – Another Flaw in the Common Log File System

The CLFS has been a repeated source of trouble. This time, the vulnerability stemmed from poor input validation—seemingly minor, but with severe consequences.

It allowed an authorized attacker to locally escalate privileges and compromise the entire system. The discovery is credited to Benoit Sevens from Google’s Threat Intelligence Group and the advanced research team at CrowdStrike.

4. CVE-2025-32709 – Flaw in Windows Ancillary Function Driver (WinSock)

This vulnerability affected the driver associated with WinSock, a network interface in Windows. Like the previous ones, it enabled local privilege escalation through a use-after-free bug.

Although the individual who reported this issue chose to remain anonymous, Microsoft confirmed and fixed the vulnerability.

5. CVE-2025-30397 – Memory Corruption in the Scripting Engine

This is the only vulnerability in the list that wasn’t about privilege escalation but rather remote code execution (RCE). It affects Microsoft’s Scripting Engine, used in both Edge and Internet Explorer.

The flaw results from a type confusion error, where the system accesses resources using an incorrect data type. An attacker could exploit this by tricking a user into clicking a malicious link. While user interaction is required, the threat remains serious. This issue was also identified by the Microsoft Threat Intelligence team.

Two Zero-Day Vulnerabilities Were Publicly Known Before the Patch

In addition to the vulnerabilities that were actively exploited, Microsoft also addressed two zero-day flaws that had already been publicly disclosed. This means that anyone with the technical know-how could have potentially exploited these issues before an official patch was released.

1. CVE-2025-26685 – Spoofing in Microsoft Defender

This vulnerability affects Microsoft Defender for Identity and allows an unauthenticated attacker to impersonate another user on a local network. The flaw stems from improper authentication handling, which makes such attacks feasible when the attacker is on the same network (for example, within a corporate environment).

Microsoft explained that a malicious actor within the network could exploit this flaw to impersonate other users and gain access to restricted resources. This issue was identified by Joshua Murrell from cybersecurity firm NetSPI.

2. CVE-2025-32702 – Remote Code Execution in Visual Studio

A critical vulnerability in Visual Studio, Microsoft’s development environment, was also fixed. It allowed an unauthenticated attacker to remotely execute malicious code on a victim’s machine.

The root cause was command injection due to poor validation of special elements within the commands used in Visual Studio. In simple terms, if an attacker got you to run a specific malicious file or action, they could take control of your system without needing prior permissions. Microsoft did not disclose the name of the researcher who reported this issue.

May 2025 Patch Tuesday Security Updates

This Patch Tuesday brought fixes for dozens of vulnerabilities (many of them critical and others quite significant) affecting both well-known products and cloud services, development tools, and office applications.

Below is a general summary of the issues addressed. There’s a bit of everything: from flaws that allowed malicious code execution or privilege escalation, to problems involving information leakage or impacting services like Azure, Defender, Visual Studio, and more.