Microsoft March 2025 Patch package fixes 57 flaws, six actively exploited and six critical

Microsoft has released its March 2025 Patch Tuesday, addressing a total of 57 security vulnerabilities. This update fixes six actively exploited zero-day vulnerabilities, one publicly disclosed zero-day. The update also includes patches for six "Critical" remote code execution vulnerabilities.

The security update addresses vulnerabilities across several categories:

• 23 Elevation of Privilege Vulnerabilities
• 3 Security Feature Bypass Vulnerabilities
• 23 Remote Code Execution Vulnerabilities
• 4 Information Disclosure Vulnerabilities
• 1 Denial of Service Vulnerability
• 3 Spoofing Vulnerabilities

The following zero-day vulnerabilities are being actively exploited in the wild:

• CVE-2025-24983 (CVSS score 7.0) - Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability. Allows local attackers to gain SYSTEM privileges by winning a race condition.
• CVE-2025-24984 (CVSS score 4.6) - Windows NTFS Information Disclosure Vulnerability. Exploitable by attackers with physical access using a malicious USB drive and allows reading portions of heap memory to steal information
• CVE-2025-24985 (CVSS score 7.8) - Windows Fast FAT File System Driver Remote Code Execution Vulnerability. Caused by an integer overflow in Windows Fast FAT Driver and exploitable by tricking users into mounting specially crafted VHD files.
• CVE-2025-24991 (CVSS score 5.5) - Windows NTFS Information Disclosure Vulnerability. Allows reading small portions of heap memory to steal information. Exploitable by tricking users into mounting malicious VHD files
• CVE-2025-24993 (CVSS score 7.8) - Windows NTFS Remote Code Execution Vulnerability. Caused by a heap-based buffer overflow bug in Windows NTFS. Exploitable by tricking users into mounting specially crafted VHD files
• CVE-2025-26633 (CVSS score 7.0) - Microsoft Management Console Security Feature Bypass Vulnerability. May involve a bug allowing malicious .msc files to bypass Windows security features. Exploitable through phishing or social engineering attacks

Publicly Disclosed Zero-Day, not reported as exploited

• CVE-2025-26630 (CVSS score 7.8) - Microsoft Access Remote Code Execution Vulnerability. Caused by a use-after-free memory bug in Microsoft Office Access. Exploitable by tricking users into opening specially crafted Access files. Cannot be exploited through the preview pane

Critical flaws

• CVE-2025-24057 (CVSS score 7.8) - Microsoft Office Remote Code Execution Vulnerability
• CVE-2025-26645 (CVSS score 8.8) - Remote Desktop Client Remote Code Execution Vulnerability     
• CVE-2025-24064 (CVSS score 8.1) - Windows Domain Name Service Remote Code Execution Vulnerability
• CVE-2025-24035 (CVSS score 8.1) - Windows Remote Desktop Services Remote Code Execution Vulnerability  
• CVE-2025-24045 (CVSS score 8.1) - Windows Remote Desktop Services Remote Code Execution Vulnerability 
• CVE-2025-24084 (CVSS score 8.4) - Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability 

Users are strongly encouraged to apply these patches immediately given the active exploitation of multiple zero-day vulnerabilities, particularly those involving Windows NTFS and VHD file manipulation. Additional information about non-security updates released today can be found in the dedicated articles for Windows 11 KB5053598 & KB5053602 cumulative updates and the Windows 10 KB5053606 update.