Microsoft fixes critical wormable Windows flaw (CVE-2025-47981)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-47981 | Unauthenticated Heap Buffer Overflow RCE in Windows SPNEGO (CVE-2025-47981) | 9.8 | 41% | PoC ×3 | |
| CVE-2025-49704 | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 | 100% | KEVRansomware | KEV |
| CVE-2025-49717 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network | 8.5 | <1% | ||
| CVE-2025-49719 | Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network | 7.5 | 11% | ||
| CVE-2025-6554 | Type Confusion in Google Chrome V8 Allows Arbitrary Read/Write (Actively Exploited) | 8.1 | 14% | KEV | KEV |
From the original article
3 min read at helpnetsecurity.com
For July 2025 Patch Tuesday, Microsoft has released patches for 130 vulnerabilities, among them one that’s publicly disclosed (CVE-2025-49719) and a wormable RCE bug on Windows and Windows Server (CVE-2025-47981). CVE-2025-49719 is an uninitialized memory disclosure vulnerability affecting Microsoft SQL Server , which can be remotely triggered by unauthorized attackers.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.