Analysis of Microsoft Patch Tuesday updates - September 2025

Executive Summary

On Tuesday, 09.09.2025, Microsoft released its monthly security patch addressing 81 vulnerabilities across its products.

By severity:

• Important - 72;
• Moderate - 1;
• Critical - 8.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following vulnerability. Fixing it is the highest priority:

• CVE-2025-55234 (CVSS 8.8; Important) - Windows SMB Elevation of Privilege Vulnerability (Elevation of Privilege). An attacker who successfully exploits this vulnerability can obtain SYSTEM-level privileges. To exploit the vulnerability, the attacker needs access to the target system and the ability to run code with low privileges.

Overview and trends

Microsoft's September 2025 Patch Tuesday includes fixes for 81 vulnerabilities, a notable decrease compared to the large summer releases in August (111) and July (130). Despite the smaller volume, the release contains a number of serious vulnerabilities that require prompt action. Key trends observed this month:

• Publicly disclosed SMB vulnerability: The main highlight this month is the fix for the publicly disclosed elevation of privilege vulnerability CVE-2025-55234 in Windows SMB. Since information about this vulnerability is already available to attackers, exploitation is highly likely. This makes the SMB patch the highest priority for all administrators.
• Dominance of elevation of privilege (EoP) vulnerabilities: As in previous months, Elevation of Privilege vulnerabilities make up the overwhelming majority of fixes. This month they affect critical components such as the Windows kernel, NTLM, SQL Server, Hyper-V, and numerous system services, indicating Microsoft's systematic efforts to harden the OS's core security mechanisms.
• Critical vulnerabilities in key components: This month, 8 critical vulnerabilities were fixed. They affect important products such as NTLM, Microsoft Office, Hyper-V, and Windows graphics components. This underscores that even with a smaller total number of vulnerabilities, the risk level remains high due to the potentially severe impact of exploitation.
• Continued focus on Routing and Remote Access Service (RRAS): The RRAS service is again in the spotlight, receiving fixes for several remote code execution (RCE) and information disclosure vulnerabilities. This continues the trend of recent months, indicating that this component remains an attractive target for security researchers and attackers.

Full List of Vulnerabilities

Below is a table with all the vulnerabilities fixed this month.

Retrospective vulnerability analysis

• CVE-2025-27480 — Windows Remote Desktop Services Remote Code Execution Vulnerability (Remote Code Execution). This vulnerability is a classic stack buffer overflow. An attacker can send a specially crafted HTTP GET request longer than 256 bytes, causing a buffer overflow on the server. This enables arbitrary code execution on the target machine without requiring authentication or user interaction, potentially resulting in remote access (reverse shell). The vulnerability was fixed in April 2025.
• CVE-2025-32713 — Windows Common Log File System Driver Elevation of Privilege Vulnerability (Elevation of Privilege). A vulnerability in the CLFS file system driver that allows a local attacker to elevate privileges. The issue stems from improper handling of metadata in BLF (Base Log File) files, leading to kernel memory corruption. An attacker can craft a malicious CLFS file whose exploitation results in code execution with SYSTEM-level privileges. The vulnerability was fixed in June 2025.
• CVE-2025-47987 — Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability (Elevation of Privilege). This vulnerability is an integer overflow that leads to a heap-based buffer overflow in tspkg.dll (Terminal Services Security Package). The issue occurs in the TSCreateKerbCertLogonBuffer function when processing authentication data, specifically certificate data. An attacker can craft an authentication request with a very large certificate length value. When calculating the total buffer size, an integer overflow occurs, causing a buffer much smaller than required to be allocated. A subsequent copy of the certificate data into this undersized buffer triggers a heap overflow, crashing lsass.exe and causing a denial of service. The vulnerability was fixed in July 2025.
• CVE-2025-49667 — Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (Elevation of Privilege). A vulnerability in the Win32 kernel subsystem that allows a local user to elevate privileges to SYSTEM. The exploit triggers a vulnerable system call that forcibly frees an object in kernel memory twice, after which the attacker can overwrite a kernel function pointer and execute their code. A PoC demonstrating this technique is available on GitHub. The vulnerability was fixed in July 2025.
• CVE-2025-50154 — Microsoft Windows File Explorer Spoofing Vulnerability (Spoofing). A vulnerability in Windows File Explorer that allows NTLMv2-SSP password hashes to be leaked without user interaction (zero-click). This is a bypass of a previous security fix. By creating a specially crafted shortcut (.LNK) that points to an executable on a remote SMB server, an attacker causes explorer.exe to automatically attempt to extract the icon from the remote file, which results in the NTLM hash being sent to the attacker's server. The vulnerability was fixed in August 2025.
• CVE-2025-53773 — GitHub Copilot and Visual Studio Remote Code Execution Vulnerability (Remote Code Execution). A prompt injection vulnerability in GitHub Copilot within VS Code that leads to remote code execution. An attacker can embed an instruction into source code or other files that modifies the project configuration (.vscode/settings.json), enabling "YOLO mode" which disables all user confirmation prompts. This allows Copilot to run shell commands and perform other dangerous actions without the developer's knowledge. The vulnerability was fixed in August 2025.

Conclusion

The September 2025 security update, while less extensive than previous ones, is a critical release due to the presence of a publicly disclosed vulnerability and eight critical fixes. IT administrators need to act quickly and strategically. Priority should be given to immediately installing updates for the following vulnerabilities:

• The publicly disclosed CVE-2025-55234 (Windows SMB, EoP) to prevent its imminent exploitation.
• All 8 critical vulnerabilities, especially those affecting NTLM (CVE-2025-54918), Microsoft Office (CVE-2025-54910), Hyper-V (CVE-2025-55224) and graphics components, as they may lead to full system compromise.

It is also recommended to prioritize updating servers with RRAS, SQL Server, and SharePoint roles, given their critical role in enterprise infrastructure. Timely patching remains a key element of defense. Delays in installing updates, especially for publicly disclosed vulnerabilities, create an unacceptable level of risk to the organization's security.