Full Report
Microsoft today issued more than 50 security updates for its various Windows operating systems, including fixes for a whopping six zero-day vulnerabilities that are already seeing active exploitation.
Analysis Summary
# Vulnerability: Microsoft Issues Patches for Six Actively Exploited Zero-Days (March 2025)
## CVE Details
- CVE ID: CVE-2025-24991, CVE-2025-24993, CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-26633 (Multiple Zero-Days)
- CVSS Score: Not explicitly listed for all, but CVE-2025-24984 is noted with a **CVSSv3 base score of 4.6 (Low/Medium)**.
- CWE: Various (Involves File System Logic, Elevation of Privilege, Memory Disclosure)
## Affected Systems
- Products: Microsoft Windows, Windows Server (Generic references provided, needing specific KB lookup for exact affected versions)
- Versions:
- CVE-2025-24983: Windows 8.1, Server 2012 R2 (Active exploitation targeted these older versions). Also present in newer versions including Windows 10 build 1809 and Windows Server 2016.
- Not vulnerable (presumably): Windows 11, Server 2019 onwards.
- Configurations: Vulnerabilities often require user interaction (mounting a malicious VHD or opening a file).
## Vulnerability Description
Microsoft addressed over 50 updates, including six zero-day vulnerabilities currently under active exploitation.
**NTFS Vulnerabilities:**
1. **CVE-2025-24991 & CVE-2025-24993:** Flaws in NTFS requiring the target to mount a crafted Virtual Hard Disk (VHD). CVE-2025-24993 could lead to **Local Code Execution (LCE)**, while CVE-2025-24991 leads to **Memory Disclosure**.
2. **CVE-2025-24984:** Another NTFS flaw, potentially exploitable by inserting a malicious USB drive. Successful exploitation may allow an attacker to dump portions of **heap memory** into a log file, aiding in information disclosure (privileged data).
3. **CVE-2025-24985:** Allows installation of malicious code, triggered when the target mounts a malicious VHD.
**Elevation of Privilege (EoP) Vulnerability:**
* **CVE-2025-24983:** An EoP vulnerability leveraged in the wild (as reported by ESET) capable of data exfiltration and remote access. Exploitation was noted targeting older OS versions (Win 8.1, Server 2012 R2).
**Microsoft Management Console (MMC) Vulnerability:**
* **CVE-2025-26633:** A flaw in MMC that requires the target to open a malicious file.
## Exploitation
- Status: **Actively exploited in the wild** (For at least CVE-2025-24983, and implied for the other five zero-days due to their inclusion in the emergency patch cycle).
- Complexity: Varies. NTFS VHD attacks require user trickery. CVE-2025-24984 severity (CVSS 4.6) suggests "practical difficulties" but allows for "toeholds."
- Attack Vector: Varies (Local via USB/VHD mounting, Requires User Interaction, or File Open).
## Impact
- Confidentiality: Potential Memory Disclosure (CVE-2025-24991), Information Disclosure (Log dumping in CVE-2025-24984), Data Exfiltration (CVE-2025-24983).
- Integrity: Potential Local Code Execution (CVE-2025-24993, CVE-2025-24985).
- Availability: Not explicitly mentioned for the zero-days, but system compromise often affects availability.
## Remediation
### Patches
- Microsoft has released updates bundled in the current Patch Tuesday release addressing all six zero-days and six critical vulnerabilities.
- **Action:** Apply all relevant Microsoft security updates immediately. (Specific KB numbers are not listed in the context, administrators must refer to the official MSRC advisory index).
### Workarounds
- None explicitly detailed as required given the availability of patches for actively exploited vulnerabilities.
- **General Precaution:** The article suggests backing up data before applying updates.
## Detection
- **Indicators of Compromise (IoCs):** Not explicitly detailed in the summary, but specific forensic IOCs are likely available in the full MSRC advisories for the *in-the-wild* exploited CVEs.
- **Detection Methods and Tools:** Administrators should monitor systems for unusual activity related to VHD manipulation, unexpected file writes to log files, or privilege escalation attempts, particularly on older Windows versions (Win 8.1/Server 2012 R2).
## References
- Vendor Advisories: Microsoft MSRC Update Guide Advisories for respective CVEs.
- Relevant Links:
- SANS Internet Storm Center: [isc[dot]sans[dot]edu/forums/diary/Microsoft%20Patch%20Tuesday%3A%20March%202025/31756/]
- AskWoody (for post-patch stability reports): [askwoody[dot]com]