RF Wave

Microsoft Releases May 2025 Software Updates

Microsoft May 2025 patches fix 72 flaws including 5 actively exploited zero-day vulnerability

  • Patch Tuesday
  • Microsoft
  • zero-day
  • active exploitation
  • elevation of privilege
  • remote code execution
  • security feature bypass
  • Windows
  • Windows Common Log File System Driver
  • Microsoft DWM Core Library
  • Windows Ancillary Function Driver for WinSock
  • Scripting Engine
  • memory corruption

Microsoft has released software updates as part of its May 2025 Patch Tuesday. The updates fix 72 security vulnerabilities in total, including 5 zero-day vulnerabilities that are being actively exploited.

The breakdown of the vulnerabilities are as follows:

  • 17 privilege escalation

  • 2 security feature bypass

  • 28 remote code execution

  • 15 information disclosure

  • 7 denial of service

  • 2 spoofing

The actively exploited vulnerabilities are as follows:

  • CVE-2025-30400 - vulnerability in Microsoft DWM Core Library that can lead to elevation of privilege

  • CVE-2025-32701 and CVE-2025-32706 - vulnerability in Windows Common Log File System Driver that can lead to elevation of privilege

  • CVE-2025-32709 - vulnerability in Windows Ancillary Function Driver for WinSock that can lead to elevation of privilege

  • CVE-2025-30397 - vulnerability in Scripting Engine that can lead to memory corruption

Why You Should Care?

Zero-day vulnerabilities are vulnerabilities where a flaw has been identified but there was no fix for the flaw, which means attackers will try to exploit as many targets as possible before users fix the vulnerability. This makes it extra dangerous, and needs to be addressed as soon as possible.

In this case, five zero-day vulnerabilities are already being exploited, which means it is only a matter of time before the attackers compromise your business. Now that patches are available, it is critical to apply the patches as soon as possible to avoid getting compromised.

What Should You Do?

  • Test the patches ASAP at your organization, and make sure it does not break any business applications

  • Prioritize patching the actively exploited zero-days

  • Roll out the rest of the Patch Tuesday updates

References