Analysis of Microsoft Patch Tuesday updates - May 2025

Executive Summary

On Tuesday, May 13, 2025, Microsoft released its monthly security patch addressing 78 vulnerabilities across its products.

By severity:

• Important - 66;
• Critical - 11;
• Low - 1.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following 7 vulnerabilities. Fixing them is the highest priority:

• CVE-2025-26685 (CVSS 6.5; Important) - Microsoft Defender for Identity Spoofing Vulnerability (Spoofing). Inadequate authentication in Microsoft Defender for Identity allows an unauthenticated attacker to impersonate another user or computer in the network.
• CVE-2025-30397 (CVSS 7.5; Important) - Scripting Engine Memory Corruption Vulnerability (Remote Code Execution). A type confusion vulnerability in Microsoft Scripting Engine allows a remote attacker to execute arbitrary code in the system.
• CVE-2025-30400 (CVSS 7.8; Important) - Microsoft DWM Core Library Elevation of Privilege Vulnerability (Elevation of Privilege). A Use-After-Free vulnerability in Desktop Window Manager allows a local authenticated attacker to elevate privileges.
• CVE-2025-32701 (CVSS 7.8; Important) - Windows Common Log File System Driver Elevation of Privilege Vulnerability (Elevation of Privilege). A Use-After-Free vulnerability in Common Log File System Driver allows a local authenticated attacker to elevate privileges.
• CVE-2025-32702 (CVSS 7.8; Important) - Visual Studio Remote Code Execution Vulnerability (Remote Code Execution). An error in Visual Studio ("Code injection") allows an unauthenticated attacker to execute code locally in the system.
• CVE-2025-32706 (CVSS 7.8; Important) - Windows Common Log File System Driver Elevation of Privilege Vulnerability (Elevation of Privilege). Incorrect input validation in the driver allows a local authenticated attacker to elevate privileges.
• CVE-2025-32709 (CVSS 7.8; Important) - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (Elevation of Privilege). CWE-416: Use-After-Free, which allows a local authenticated attacker to elevate privileges.

General Overview and trends

Microsoft’s May 2025 Patch Tuesday was particularly substantial, addressing 78 vulnerabilities. The distribution by severity shows that the majority (66) are classified as "Important", 11 vulnerabilities are classified as "Critical", and require immediate attention. Key trends observed this month include:

• Elevation of Privilege vulnerability mitigation: The majority of the fixes (especially among the priority ones) are aimed at mitigating Elevation of Privilege vulnerabilities. This indicates that Microsoft is continuing to strengthen the security of Windows and related components.
• Vulnerabilities in Microsoft Office and related applications: A large number of vulnerabilities (mainly Remote Code Execution) were discovered in Microsoft Office, including Excel and PowerPoint. This underscores the importance of regularly updating these applications, as they are often targeted by attackers.
• Vulnerabilities in cloud services: Fixes for Azure DevOps Server, Azure Automation, Azure Storage, and other cloud services indicate the growing complexity of ensuring security in cloud infrastructures.
• Remote Code Execution vulnerabilities: The significant number of vulnerabilities allowing remote code execution require special attention, as they can be used to compromise systems without requiring physical access.
• Vulnerabilities in Windows components: The discovery of vulnerabilities in key Windows components, such as Windows Media, Remote Desktop Services, and the Windows Kernel, underscores the need for a comprehensive approach to ensuring the security of the operating system. In general, the May 2025 Patch Tuesday demonstrates a wide range of vulnerabilities affecting various Microsoft products and services. It is recommended to prioritize the installation of updates, especially for vulnerabilities with a high severity rating and those that are actively being exploited.

Full List of Vulnerabilities

Below is a table of all vulnerabilities fixed this month.

Conclusion

May's Patch Tuesday 2025 requires organizations to take a proactive approach to vulnerability management. The focus on fixes for Windows, cloud services, and developer products indicates an expansion of the attack surface and the need for a comprehensive security strategy. In addition to installing updates, it is recommended to analyze the impact of vulnerabilities on a specific infrastructure and consider additional security measures, such as network segmentation and enhanced monitoring. Given the wide range of affected products, automating the update process and regularly scanning for vulnerabilities will become key factors in maintaining a secure environment. It is important to note that the lack of information about active exploitation of vulnerabilities at the moment does not justify a decrease in the priority of their elimination. Information about vulnerabilities becomes publicly available, and attackers can quickly develop exploits, even if they have not yet been detected in the wild. Therefore, timely patching remains critically important for preventing potential attacks and protecting against future threats.