Microsoft May 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws

Today is Microsoft’s May 2025 Patch Tuesday, which includes security updates for 72 flaws, including five actively exploited and two publicly disclosed zero-day vulnerabilities.

This Patch Tuesday also fixes six “Critical” vulnerabilities, five being remote code execution vulnerabilities and another an information disclosure bug.

The number of bugs in each vulnerability category is listed below:

• 17 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 28 Remote Code Execution Vulnerabilities
• 15 Information Disclosure Vulnerabilities
• 7 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

This count does not include Azure, Dataverse, Mariner, and Microsoft Edge flaws that were fixed earlier this month.

To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5058411 and KB5058405 cumulative updates and the Windows 10 KB5058379 update.

Five actively exploited zero-days

This month’s Patch Tuesday fixes one actively exploited zero-day. Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited while no official fix is available.

The actively exploited zero-day vulnerability in today’s updates is:

CVE-2025-30400 – Microsoft DWM Core Library Elevation of Privilege Vulnerability

Microsoft fixed an exploited elevation of privileges vulnerability that gives attackers SYSTEM privileges.

“Use after free in Windows DWM allows an authorized attacker to elevate privileges locally,” reads the advisory.

Microsoft attributes the discovery of this flaw to the Microsoft Threat Intelligence Center.

CVE-2025-32701 – Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft fixed an exploited elevation of privileges vulnerability that gives attackers SYSTEM privileges.

“Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally,” reads the advisory.

Microsoft attributes the discovery of this flaw to the Microsoft Threat Intelligence Center.

CVE-2025-32706 – Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft fixed an exploited elevation of privileges vulnerability that gives attackers SYSTEM privileges.

“Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally,” explains the advisory.

Microsoft attributes the discovery of this flaw to Benoit Sevens of Google Threat Intelligence Group and the CrowdStrike Advanced Research Team.

CVE-2025-32709 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Microsoft fixed an exploited elevation of privileges vulnerability that gives attackers SYSTEM privileges.

“Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally,” explains Microsoft’s advisory.

This flaw was disclosed by an “Anonymous” researcher.

CVE-2025-30397 – Scripting Engine Memory Corruption Vulnerability

Microsoft fixed a remote code execution vulnerability that can be exploited through Microsoft Edge or Internet Explorer.

“Access of resource using incompatible type (‘type confusion’) in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network,” explains Microsoft.

Microsoft says that threat actors need to trick an authenticated user into clicking on a specially crafted link in Edge or Internet Explorer, allowing an unauthenticated attacker to gain remote code execution.

Microsoft attributes the discovery of this flaw to the Microsoft Threat Intelligence Center.

Microsoft has not shared any details on how these flaws were exploited in attacks.

The publicly disclosed zero-days are:

CVE-2025-26685 – Microsoft Defender for Identity Spoofing Vulnerability

Microsoft fixes a flaw in Microsoft Defender that allows an unauthenticated attack to spoof another account.

“Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network,” explains Microsoft.

The flaw can be exploited by an unauthenticated attacker with LAN access.

Microsoft attributes the discovery of this flaw to Joshua Murrell with NetSPI.

CVE-2025-32702 – Visual Studio Remote Code Execution Vulnerability

Microsoft fixed a Visual Studio remote code execution flaw that can be exploited by an unauthenticated attacker.

“Improper neutralization of special elements used in a command (‘command injection’) in Visual Studio allows an unauthorized attacker to execute code locally,” explains Microsoft.

Microsoft has not shared who disclosed this flaw.

Recent updates from other companies

Other vendors who released updates or advisories in May 2025 include:

The May 2025 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the May 2025 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.

Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them.

Read the Red Report 2025