Pierluigi Paganini March 12, 2025

Microsoft Patch Tuesday security updates for March 2025 address 56 security vulnerabilities in its products, including six actively exploited zero-days.

Microsoft Patch Tuesday security updates for March 2025 addressed 56 vulnerabilities in Windows and Windows Components, Office and Office Components, Azure, .NET and Visual Studio, Remote Desktop Services, DNS Server, and Hyper-V Server.

This Patch Tuesday stands out for the number of actively exploited zero-day vulnerabilities addressed by the IT giant, which totals six.

Six vulnerabilities are rated Critical, and 50 are rated Important in severity.

“Of the patches released today, six are rated Critical, and 50 are rated Important in severity. This is nearly identical to the release last month in volume, but the number of actively exploited bugs is extraordinary.” reported ZDI. “One of these bugs is listed as publicly known, and six(!) others are listed as under active attack at the time of release”

The six vulnerabilities that have been actively exploited in the wild are:

• CVE-2025-24983 (CVSS 7.0): A use-after-free vulnerability in the Windows Win32 Kernel Subsystem that enables authorized attackers to escalate privileges locally.
• CVE-2025-24984 (CVSS 4.6): An NTFS information disclosure flaw that lets attackers with physical access and a malicious USB device read portions of heap memory.
• CVE-2025-24985 (CVSS 7.8): An integer overflow in the Windows Fast FAT File System Driver allowing unauthorized local code execution.
• CVE-2025-24991 (CVSS 5.5): An out-of-bounds read vulnerability in NTFS that permits authorized attackers to access sensitive information.
• CVE-2025-24993 (CVSS 7.8): A heap-based buffer overflow in NTFS that allows unauthorized local code execution.
• CVE-2025-26633 (CVSS 7.0): An improper neutralization flaw in Microsoft Management Console that lets unauthorized attackers bypass security features locally.

ESET researchers, who discovered the vulnerability CVE-2025-24983, reported that the zero-day CVE-2025-24983 has been exploited since March 2023. The flaw enables attackers with low privileges to escalate to SYSTEM privileges but requires winning a race condition. The exploit, linked to the PipeMagic backdoor, has targeted unsupported Windows versions like Server 2012 R2 and 8.1 but also affects Windows 10 (build 1809 and earlier) and Server 2016.

The full list of vulnerabilities addressed by Microsoft Patch Tuesday security updates for March 2025 is available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Patch Tuesday)