Microsoft Fixes Over 130 CVEs in April Patch Tuesday
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-27472 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network | 5.4 | 2% | ||
| CVE-2025-29824 | Use-After-Free Privilege Escalation in Microsoft Windows CLFS Driver (Actively Exploited) | 7.8 | 19% | KEVRansomwarePoC ×2 | KEV |
From the original article
2 min read at infosecurity-magazine.com
System administrators have double the workload this month versus March’s Patch Tuesday announcement, after Microsoft published fixes for over 130 CVEs. However, there was only one zero-day bug announced this month, compared to seven in March. CVE-2025-29824 is an actively exploited elevation of privilege (EoP) vulnerability in the Windows Common Log File System (CLFS), that stems from a use-after-free condition.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.