Microsoft Patches 130 Vulnerabilities, Including Critical Flaws in SPNEGO and SQL Server
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-47981+4 related CVEs | Unauthenticated Heap Buffer Overflow RCE in Windows SPNEGO (CVE-2025-47981) | 9.8 group max | 41% | PoC ×3 | |
| CVE-2025-48003 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack | 6.8 | <1% | ||
| CVE-2025-48822 | Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally | 8.6 | <1% | ||
CVE-2025-49695+1 related CVE | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally | 8.4 | <1% | ||
| CVE-2025-49719 | Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network | 7.5 | 11% | ||
| CVE-2025-49735 | Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network | 8.1 | 1% |
From the original article
4 min read at thehackernews.com
For the first time in 2025, Microsoft's Patch Tuesday updates did not bundle fixes for exploited security vulnerabilities, but the company acknowledged one of the addressed flaws had been publicly known. The patches resolve a whopping 130 vulnerabilities , along with 10 other non-Microsoft CVEs that affect Visual Studio, AMD, and its Chromium-based Edge browser.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.