Full Report
Today is Microsoft's May 2025 Patch Tuesday, which includes security updates for 72 flaws, including five actively exploited and two publicly disclosed zero-day vulnerabilities. [...]
Analysis Summary
This summary focuses on the security vulnerabilities disclosed during Microsoft's May 2025 Patch Tuesday.
# Vulnerability: Microsoft May 2025 Patch Tuesday Summary
## CVE Details
- CVE ID: Multiple (e.g., CVE-2025-30400, CVE-2025-32701, CVE-2025-30397, CVE-2025-29833, etc.)
- CVSS Score: Severity varied (Includes 6 Critical vulnerabilities; specific scores are not provided in the text for all entries, but Critical implies high severity, CVSS 9.0+)
- CWE: Various, including Use After Free, Improper Input Validation, Command Injection, Improper Authentication, and Type Confusion.
## Affected Systems
- **Products:** Microsoft DWM Core Library, Windows Common Log File System Driver, Windows Ancillary Function Driver for WinSock, Microsoft Scripting Engine (Edge/IE), Microsoft Defender for Identity, Visual Studio, Windows Routing and Remote Access Service (RRAS), Windows Secure Kernel Mode components, Windows SMB, Windows Trusted Runtime Interface Driver, Microsoft Virtual Machine Bus (VMBus), Windows Win32K - GRFX.
- **Versions:** Not explicitly listed, but assumed to be various supported versions of Windows and associated software components impacted by these components.
- **Configurations:** Exploitation often requires local access for LoEs, while RCE via Scripting Engine requires tricking an authenticated user into visiting a malicious link. Defender for Identity spoofing requires LAN/adjacent network access.
## Vulnerability Description
Microsoft addressed 72 flaws this month, which includes six "Critical" vulnerabilities (five RCEs and one Information Disclosure). Five vulnerabilities were actively exploited zero-days, and two were publicly disclosed zero-days.
**Key Exploited Zero-Days (All result in SYSTEM-level Elevation of Privilege unless noted):**
1. **CVE-2025-30400 (DWM Core Library):** Use After Free leading to local Privilege Escalation.
2. **CVE-2025-32701 (Common Log File System Driver):** Use After Free leading to local Privilege Escalation.
3. **CVE-2025-32706 (Common Log File System Driver):** Improper Input Validation leading to local Privilege Escalation.
4. **CVE-2025-32709 (WinSock Ancillary Function Driver):** Use After Free leading to local Privilege Escalation.
5. **CVE-2025-30397 (Scripting Engine):** Access of resource using incompatible type (Type Confusion) allowing **Remote Code Execution** if an authenticated user visits a crafted link.
**Critical Vulnerability Example:**
* **CVE-2025-29833 (VMBus RCE):** A Critical RCE vulnerability in the Microsoft Virtual Machine Bus.
## Exploitation
- **Status:** Five vulnerabilities were **Actively exploited in the wild** (all privilege escalations), and two others were **Publicly disclosed** (one spoofing, one Visual Studio RCE).
- **Complexity:** Varies. Local Privilege Escalations typically require some level of initial access. The RCE via Scripting Engine requires user interaction (Low complexity for remote attack).
- **Attack Vector:** Network (for RCE in Scripting Engine), Local (for most EoPs), Adjacent Network (for CVE-2025-26685 spoofing).
## Impact
- **Confidentiality:** Impacts vary, with several Information Disclosure flaws present.
- **Integrity:** High, as five publicly known flaws led to SYSTEM-level privilege escalation when successfully exploited.
- **Availability:** Several Denial of Service flaws were patched, though specific impact levels are not detailed.
## Remediation
### Patches
Patches are available as part of the May 2025 Patch Tuesday cumulative updates. Specific KB numbers mentioned for non-security updates are KB5058411, KB5058405 (Windows 11), and KB5058379 (Windows 10). Users should apply the relevant cumulative updates containing the security fixes.
### Workarounds
No specific workarounds are detailed in the provided text aside from applying the security updates. For the zero-day Scripting Engine flaw, users visiting untrusted content would be at risk until patched.
## Detection
- **Indicators of Compromise (IOCs):** Not detailed, but monitoring for unusual process creation or privilege escalation attempts related to DWM, CLFS, or WinSock drivers should be prioritized, especially immediately prior to patch application.
- **Detection Methods and Tools:** Standard endpoint detection and response (EDR) tools should be configured to look for exploitation patterns related to Use After Free or Command Injection in the affected components. Focus on monitoring network/browser activity related to IE/Edge leading up to the patch deployment for CVE-2025-30397.
## References
- Microsoft MSRC Advisories (Linked by CVE ID, e.g., http://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-30400)
- Dedicated articles on Windows 11 KB5058411 and KB5058405 cumulative updates
- Dedicated article on the Windows 10 KB5058379 update