Analysis of Microsoft Patch Tuesday updates - April 2025

Executive Summary

On Tuesday, April 08, 2025, Microsoft released its monthly security patch, addressing 126 vulnerabilities across its products.

By severity:

• Critical - 11;
• Important - 112;
• Low - 2.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following vulnerability. Fixing it is the highest priority:

• CVE-2025-29824 (CVSS 7.8; Important) - Windows Common Log File System Driver Elevation of Privilege Vulnerability (Elevation of Privilege). The CWE-416: Use After Free vulnerability in the Windows Common Log File System Driver allows a local attacker to elevate privileges from user level to System.

General Overview and Trends

The April Patch Tuesday release includes a significant number of fixes spanning a wide range of Microsoft products. The largest number of vulnerabilities were addressed in Windows components (including the kernel, services, and applications), as well as in Microsoft Office and Edge.

• Predominance of Elevation of Privilege vulnerabilities: Most vulnerabilities (around 40%) relate to privilege escalation. This indicates ongoing security issues in access-rights management across Microsoft operating systems and applications.
• Remote Code Execution (RCE) vulnerabilities: 33 vulnerabilities are classified as Critical or Important and enable remote code execution. These vulnerabilities pose a serious threat as one of the most dangerous vulnerability classes.
• Vulnerabilities in Office: A significant number of vulnerabilities were found in Microsoft Office, including Word, Excel, and SharePoint. This highlights the importance of timely Office updates and using the latest versions.
• Vulnerabilities in Edge: Fixes also affected the Microsoft Edge (Chromium-based) browser, underscoring the continued relevance of threats originating from web browsers.
• Vulnerabilities in RDP: The presence of several vulnerabilities in Remote Desktop Services (RDP) requires special attention, since RDP is often used for legitimate purposes and is also a target for attackers.

Full List of Vulnerabilities

Below is a table of all vulnerabilities fixed this month.