Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-29967+2 related CVEs | Heap-based buffer overflow in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network | 8.8 group max | 1% | ||
| CVE-2025-29841 | Concurrent execution using shared resource with improper synchronization ('race condition') in Universal Print Management Service allows an authorized attacker… | 7.0 | <1% | ||
| CVE-2025-29966 | Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network | 8.8 | 1% | ||
| CVE-2025-29971 | Out-of-Bounds Read DoS in Microsoft Windows 11 Web Threat Defense (WTD.sys) Driver | 7.5 | 64% | ||
CVE-2025-30382+1 related CVE | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally | 7.8 | 2% | ||
CVE-2025-30386+1 related CVE | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally | 7.8 | <1% | ||
| CVE-2025-30385 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally | 7.8 | <1% | ||
| CVE-2025-30388 | Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally | 7.8 | 4% | ||
| CVE-2025-30390 | Improper authorization in Azure allows an authorized attacker to elevate privileges over a network | 8.8 | <1% | ||
CVE-2025-32706+4 related CVEs | Heap-Based Buffer Overflow in Windows CLFS Driver Enables Local Privilege Escalation | 7.8 group max | 2% | KEVPoC ×2 | KEV |
| CVE-2025-30398 | Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network | 8.1 | <1% |
From the original article
2 min read at blog.talosintelligence.com
Microsoft has released its monthly security update for May of 2025 which includes 78 vulnerabilities affecting a range of products, including 11 that Microsoft marked as “critical”. Microsoft noted five vulnerabilities that have been observed to be exploited in the wild. CVE-2025-30397 is a remote code execution vulnerability in the Microsoft Scripting Engine.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.