What’s New Wednesday: A Summary of May 2025’s Patch Tuesday May 14, 2025 – Posted in: Cyber Security, IT Support, What's New Wednesdays – Tags: cybersecurity, Patch Tuesday, patching, SmallBusiness, WhatsNewWednesday

Welcome to Patch Tuesday May 2025. 72 flaws were patched including 6 critical and 2 zero-day vulnerabilities, both of which have been actively exploited. It’s a good idea to restart your PC today, and we may well restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

Overall Microsoft patched:

• 17 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 28 Remote Code Execution Vulnerabilities
• 15 Information Disclosure Vulnerabilities
• 7 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerability

There were 5 actively exploited or publicly disclosed zero-day vulnerabilities patched:
CVE-2025-30400 – Microsoft DWM Core Library, CVE-2025-32701 – Windows Common Log File System Driver, and CVE-2025-32709 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Microsoft fixed exploited elevation of privileges vulnerabilities in Windows DWM, Windows Common Log File System Driver, and Windows Ancillary Function Driver for WinSock that allow an authorized attacker to elevate privileges locally and gives attackers SYSTEM privileges.
CVE-2025-30397 – Scripting Engine Memory Corruption Vulnerability
Microsoft fixed a remote code execution vulnerability that can be exploited through Microsoft Edge or Internet Explorer. Access of resource using incompatible type (‘type confusion’) in Microsoft Scripting Engine allowed an unauthorized attacker to execute code over a network.
CVE-2025-26685 – Microsoft Defender for Identity Spoofing Vulnerability
Microsoft fixed a flaw in Microsoft Defender for Identity that allowed an unauthenticated attack to spoof another account via local network access.
CVE-2025-32702 – Visual Studio Remote Code Execution Vulnerability
Microsoft fixed a Visual Studio remote code execution flaw where improper neutralization of special elements used in a command (‘command injection’)allowed an unauthorized attacker to execute code locally.

Releases from other software providers include:

• Apple – security updates for iOS, iPadOS, and macOS.
• Cisco – a maximum severity vulnerability in IOS XE Software for Wireless LAN Controllers.
• Fortinet – security updates for numerous products, including an actively exploited zero day used in attacks on FortiVoice.
• Google – May 2025 security updates for Android fixed an actively exploited zero-click FreeType 2 code execution vulnerability.
• Intel – CPU microcodes for a flaw named “Branch Privilege Injection” that leaks data from privileged memory.
• SAP – security updates for multiple products, including a critical RCE flaw.
• SonicWall – a zero-day vulnerability that was exploited in attacks.

FULL LIST OF MICROSOFT PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.