Microsoft releases May 2025 Patch Tuesday updates addressing 72 vulnerabilities
Take action: This month prioritize updating Windows OS patching, Microsoft Defender, Visual Studio and Microsoft office. All these havee actively exploited flaws. Then move on to Azure Devops and Powerapps, they carry critical flaws which will probably be next in line to be attacked. Don't delay on the Windows update, there are actively exploited flaws.
Learn More
Microsoft has released its May 2025 Patch Tuesday security updates, addressing a total of 72 vulnerabilities across its product ecosystem. This update includes patches for five actively exploited zero-day vulnerabilities and two publicly disclosed zero-day flaws.
Actively Exploited Zero-Day Vulnerabilities
- CVE-2025-30400 - Microres tricking authenticated users into clicking specially crafted links in Edge or Internet Explorer
Microsoft has not provided specific details on how these vulnerabilities were exploited in real-world attacks.
Two publicly disclosed zero-day vulnerabilities have also been patched:
- CVE-2025-26685 - Microsoft Defender for Identity Spoofing Vulnerability. Allows unauthenticated attackers with LAN access to spoof another account due to improper authentication
- CVE-2025-32702 - Visual Studio Remote Code Execution Vulnerability. Enables unauthenticated attackers to execute code locally through command injection
Critical flaws
- CVE-2025-33072 - Microsoft msagsfeedback.azurewebsites.net Information Disclosure Vulnerability
- CVE-2025-29827 - Azure Automation Elevation of Privilege Vulnerability
- CVE-2025-29813 - Azure DevOps Server Elevation of Privilege Vulnerability
- CVE-2025-29972 - Azure Storage Resource Provider Spoofing Vulnerability
- CVE-2025-47732 - Microsoft Dataverse Remote Code Execution Vulnerability
- CVE-2025-30377 - Microsoft Office Remote Code Execution Vulnerability
- CVE-2025-30386 - Microsoft Office Remote Code Execution Vulnerability
- CVE-2025-47733 - Microsoft Power Apps Information Disclosure Vulnerability
- CVE-2025-29967 - Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2025-29966 - Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2025-29833 - Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
The May 2025 Patch Tuesday addresses vulnerabilities across multiple severity levels and categories:
- 17 Elevation of Privilege Vulnerabilities
- 2 Security Feature Bypass Vulnerabilities
- 28 Remote Code Execution Vulnerabilities
- 15 Information Disclosure Vulnerabilities
- 7 Denial of Service Vulnerabilities
- 2 Spoofing Vulnerabilities
Full list of fixes
| Tag | CVE ID | CVE Title | Severity |
|---|---|---|---|
| .NET, Visual Studio, and Build Tools for Visual Studio | CVE-2025-26646 | .NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability | Important |
| Active Directory Certificate Services (AD CS) | CVE-2025-29968 | Active Directory Certificate Services (AD CS) Denial of Service Vulnerability | Important |
| Azure | CVE-2025-33072 | Microsoft msagsfeedback.azurewebsites.net Information Disclosure Vulnerability | Critical |
| Azure | CVE-2025-30387 | Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability | Important |
| Azure Automation | CVE-2025-29827 | Azure Automation Elevation of Privilege Vulnerability | Critical |
| Azure DevOps | CVE-2025-29813 | Azure DevOps Server Elevation of Privilege Vulnerability | Critical |
| Azure File Sync | CVE-2025-29973 | Microsoft Azure File Sync Elevation of Privilege Vulnerability | Important |
| Azure Storage Resource Provider | CVE-2025-29972 | Azure Storage Resource Provider Spoofing Vulnerability | Critical |
| Microsoft Brokering File System | CVE-2025-29970 | Microsoft Brokering File System Elevation of Privilege Vulnerability | Important |
| Microsoft Dataverse | CVE-2025-47732 | Microsoft Dataverse Remote Code Execution Vulnerability | Critical |
| Microsoft Dataverse | CVE-2025-29826 | Microsoft Dataverse Elevation of Privilege Vulnerability | Important |
| Microsoft Defender for Endpoint | CVE-2025-26684 | Microsoft Defender Elevation of Privilege Vulnerability | Important |
| Microsoft Defender for Identity | CVE-2025-26685 | Microsoft Defender for Identity Spoofing Vulnerability | Important |
| Microsoft Edge (Chromium-based) | CVE-2025-4050 | Chromium: CVE-2025-4050 Out of bounds memory access in DevTools | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-4096 | Chromium: CVE-2025-4096 Heap buffer overflow in HTML | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-29825 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | Low |
| Microsoft Edge (Chromium-based) | CVE-2025-4052 | Chromium: CVE-2025-4052 Inappropriate implementation in DevTools | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-4051 | Chromium: CVE-2025-4051 Insufficient data validation in DevTools | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-4372 | Chromium: CVE-2025-4372 Use after free in WebAudio | Unknown |
| Microsoft Office | CVE-2025-30377 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office | CVE-2025-30386 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2025-29977 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-30383 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-29979 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-30376 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-30393 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-32704 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-30375 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-30379 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-30381 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Outlook | CVE-2025-32705 | Microsoft Outlook Remote Code Execution Vulnerability | Important |
| Microsoft Office PowerPoint | CVE-2025-29978 | Microsoft PowerPoint Remote Code Execution Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2025-30378 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2025-30382 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2025-30384 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2025-29976 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Important |
| Microsoft PC Manager | CVE-2025-29975 | Microsoft PC Manager Elevation of Privilege Vulnerability | Important |
| Microsoft Power Apps | CVE-2025-47733 | Microsoft Power Apps Information Disclosure Vulnerability | Critical |
| Microsoft Scripting Engine | CVE-2025-30397 | Scripting Engine Memory Corruption Vulnerability | Important |
| Remote Desktop Gateway Service | CVE-2025-26677 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability | Important |
| Remote Desktop Gateway Service | CVE-2025-29967 | Remote Desktop Client Remote Code Execution Vulnerability | Critical |
| Remote Desktop Gateway Service | CVE-2025-29831 | Windows Remote Desktop Services Remote Code Execution Vulnerability | Important |
| Remote Desktop Gateway Service | CVE-2025-30394 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2025-29955 | Windows Hyper-V Denial of Service Vulnerability | Important |
| Universal Print Management Service | CVE-2025-29841 | Universal Print Management Service Elevation of Privilege Vulnerability | Important |
| UrlMon | CVE-2025-29842 | UrlMon Security Feature Bypass Vulnerability | Important |
| Visual Studio | CVE-2025-32703 | Visual Studio Information Disclosure Vulnerability | Important |
| Visual Studio | CVE-2025-32702 | Visual Studio Remote Code Execution Vulnerability | Important |
| Visual Studio Code | CVE-2025-21264 | Visual Studio Code Security Feature Bypass Vulnerability | Important |
| Web Threat Defense (WTD.sys) | CVE-2025-29971 | Web Threat Defense (WTD.sys) Denial of Service Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2025-32709 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Common Log File System Driver | CVE-2025-32701 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Important |
| Windows Common Log File System Driver | CVE-2025-30385 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Important |
| Windows Common Log File System Driver | CVE-2025-32706 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Important |
| Windows Deployment Services | CVE-2025-29957 | Windows Deployment Services Denial of Service Vulnerability | Important |
| Windows Drivers | CVE-2025-29838 | Windows ExecutionContext Driver Elevation of Privilege Vulnerability | Important |
| Windows DWM | CVE-2025-30400 | Microsoft DWM Core Library Elevation of Privilege Vulnerability | Important |
| Windows File Server | CVE-2025-29839 | Windows Multiple UNC Provider Driver Information Disclosure Vulnerability | Important |
| Windows Fundamentals | CVE-2025-29969 | MS-EVEN RPC Remote Code Execution Vulnerability | Important |
| Windows Hardware Lab Kit | CVE-2025-27488 | Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability | Important |
| Windows Installer | CVE-2025-29837 | Windows Installer Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2025-24063 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2025-29974 | Windows Kernel Information Disclosure Vulnerability | Important |
| Windows LDAP - Lightweight Directory Access Protocol | CVE-2025-29954 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | Important |
| Windows Media | CVE-2025-29962 | Windows Media Remote Code Execution Vulnerability | Important |
| Windows Media | CVE-2025-29963 | Windows Media Remote Code Execution Vulnerability | Important |
| Windows Media | CVE-2025-29964 | Windows Media Remote Code Execution Vulnerability | Important |
| Windows Media | CVE-2025-29840 | Windows Media Remote Code Execution Vulnerability | Important |
| Windows NTFS | CVE-2025-32707 | NTFS Elevation of Privilege Vulnerability | Important |
| Windows Remote Desktop | CVE-2025-29966 | Remote Desktop Client Remote Code Execution Vulnerability | Critical |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29836 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29959 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29835 | Windows Remote Access Connection Manager Information Disclosure Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29960 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29832 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29830 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29961 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29958 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Important |
| Windows Secure Kernel Mode | CVE-2025-27468 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | Important |
| Windows SMB | CVE-2025-29956 | Windows SMB Information Disclosure Vulnerability | Important |
| Windows Trusted Runtime Interface Driver | CVE-2025-29829 | Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability | Important |
| Windows Virtual Machine Bus | CVE-2025-29833 | Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability | Critical |
| Windows Win32K - GRFX | CVE-2025-30388 | Windows Graphics Component Remote Code Execution Vulnerability | Important |
