Full Report
Microsoft has released its monthly security update for March of 2025 which includes 57 vulnerabilities affecting a range of products, including 6 that Microsoft marked as “critical”.
Analysis Summary
# Vulnerability: Summary of Microsoft March 2025 Security Updates (Zero-Days Highlighted)
## CVE Details
- CVE ID: Multiple (e.g., CVE-2025-26633, CVE-2025-26633, CVE-2025-24035, CVE-2024-9157)
- CVSS Score: Ranges from 8.1 to 9.9 (Critical/High)
- CWE: Varies (e.g., Use After Free, Improper Access Control, Untrusted Pointer Dereference)
## Affected Systems
- Products: Microsoft Management Console, Windows NTFS, Windows Kernel Subsystem, Windows Remote Desktop Gateway (RD Gateway), Synaptics Audio Effect Component, Windows Domain Name Service (DNS), Windows Subsystem for Linux (WSL2), Remote Desktop (RDP) Client, Microsoft Office, Windows Routing and Remote Access Service (RRAS), Windows Telephony Service.
- Versions: Not explicitly listed; applies to unspecified vulnerable versions across the affected products, addressed by the March 2025 security updates.
- Configurations: Specific configurations mentioned for RCEs in RD Gateway (requires RD Gateway role); WSL2 RCE requires elevated privileges.
## Vulnerability Description
Microsoft released 57 vulnerabilities in its March 2025 update, six of which are critical. Several vulnerabilities across Windows components are being exploited in the wild, including RCE in MMC, Information Disclosure and RCE in NTFS, RCE in the Windows Fast FAT system driver, and an EOP in the kernel subsystem.
**Key Critical/High Vulnerabilities:**
* **CVE-2025-24035 / CVE-2025-24045 (RD Gateway RCE):** Both are User-after-free (UAF) issues related to websocket initialization/closing (24035) or connection/disconnection callbacks (24045) in the RD Gateway service, leading to potential arbitrary code execution.
* **CVE-2024-9157 (Synaptics EOP):** Caused by a Synaptics DLL loading mechanism via a named pipe without proper ACLs, allowing remote unprivileged users to load a malicious DLL in the service context. (CVSS 9.9)
* **CVE-2025-24064 (Windows DNS RCE):** A UAF condition triggered by sending a perfectly timed DNS update message.
* **CVE-2025-24084 (WSL2 RCE):** Caused by an untrusted pointer dereference, requiring elevated privileges to exploit.
* **CVE-2025-26645 (RDP Client RCE):** Relative path traversal issue allowing an RDP server to achieve RCE on connecting client machines.
## Exploitation
- Status: **Exploited in the wild** for CVE-2025-26633 (MMC RCE), CVE-2025-24984/24991 (NTFS Info Disclosure), CVE-2025-24993 (NTFS RCE), CVE-2025-24985 (Fast FAT RCE), and CVE-2025-24983 (Kernel EOP).
- Complexity: Varies. CVE-2025-24035/24045 are remote, unauthenticated (RD Gateway). CVE-2024-9157 is highly complex EOP that allows remote execution via malicious DLL loading.
- Attack Vector: Primarily Network (for remote services like RD Gateway, DNS) and Local (for some EOP/privilege escalations).
## Impact
- Confidentiality: Information disclosure noted for two NTFS vulnerabilities.
- Integrity: RCE vulnerabilities allow arbitrary code execution, leading to full integrity compromise.
- Availability: RCE and EOP can lead to system crashes or service disruption.
## Remediation
### Patches
- All tracked vulnerabilities are addressed in the **Microsoft March 2025 Security Updates**. Specific fixed versions are available via Microsoft's update guide referencing the CVEs listed (e.g., for CVE-2025-24035).
### Workarounds
- No specific workarounds were detailed in the summary for the zero-day/widely exploited vulnerabilities, emphasizing patching as primary remediation. For RD Gateway vulnerabilities (CVE-2025-24035/24045), restricting external access where possible might serve as a temporary measure until patching is complete.
## Detection
- **Indicators of Compromise (IoCs):** Not explicitly detailed, but exploitation involves conditions like successful DNS update attacks, specific RDP connection sequences, or unauthorized DLL loading attempts near Synaptics components.
- **Detection Methods and Tools:** Talos released Snort rule sets to detect exploitation attempts:
- Snort (Original): 64663, 64662, 64432, 64658, 64659, 64656, 64657, 64660, 64661, 64653, 64652.
- Snort 3: 64432, 301166, 301164, 301163, 301165, 301162.
## References
- Vendor Advisories: Microsoft March 2025 Security Update Guide
- Relevant links:
- ms rc dot microsoft dot com slash update-guide slash en-US slash vulnerability slash CVE-2025-26633
- ms rc dot microsoft dot com slash update-guide slash en-US slash vulnerability slash CVE-2025-24035
- snort dot org