Last Windows 10 Patch Tuesday Features Six Zero

Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity.

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.

CVE-2025-24990 is an untrusted pointer dereference (CWE-822) in the third-party Agere modem driver (ltmdm64.sys) that Microsoft ships natively with supported Windows client and server operating systems. Exploitation requires local access with limited privileges, and successful attacks yield high impact to the system's confidentiality, integrity, and availability (CVSS 3.1 7.8), a scoring pattern consistent with local privilege escalation. Because the driver is present by default, every supported Windows 10 build, Windows 11 build, and Windows Server 2008/2012/2016 installation listed by Microsoft is affected until patched. The flaw is being actively exploited in the wild — it was added to CISA's KEV on 2025-10-14 — although no public proof-of-concept is known. Microsoft remediated it in the October 2025 cumulative updates by removing ltmdm64.sys entirely, which means fax modem hardware that depends on this driver will stop working after patching.

Do: Apply the October 2025 (or later) Windows cumulative update, which remediates the flaw by removing ltmdm64.sys, and prioritize systems where untrusted or low-privileged users can run code (RDS/VDI hosts, shared workstations, jump servers). After patching, check for Agere-based fax modem dependencies tied to ltmdm64.sys, as that hardware will no longer function and will need replacement or an alternative. Federal agencies must apply mitigations per vendor instructions or follow BOD 22-01 timelines for cloud services.

TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0

CVE-2025-47827 is a Secure Boot bypass in IGEL OS before version 11, caused by improper verification of a cryptographic signature (CWE-347) in the igel-flash-driver module, which improperly validates a signature using a key past its expiration date. An attacker with physical access (CVSS vector AV:P) can boot a crafted root filesystem from an unverified SquashFS image, defeating the platform's Secure Boot guarantee and loading attacker-controlled code at boot time; the CVSS scoring assigns high availability impact. Deployments running IGEL OS 10 or earlier are affected; CISA's affected-product list names IGEL OS only, while the CPE data additionally tags Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2-25H2) and Windows Server 2012/2016 releases, reflecting the shared Microsoft Secure Boot key ecosystem rather than a CISA-listed Microsoft impact. The flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2025-10-14, indicating confirmed in-the-wild exploitation, with ransomware use unknown and EPSS estimating a 4.9% (92nd percentile) probability of exploitation within 30 days. A public proof-of-concept is available (github.com/Zedeldi/CVE-2025-47827), and vendors/CISA have required mitigation per BOD 22-01 guidance.

Do: Inventory all IGEL endpoints and upgrade any running OS 10 or earlier to IGEL OS 11 (current 11.x) per vendor instructions, which is the required KEV/BOD 22-01 remediation path. Because the attack requires physical access (AV:P), restrict physical and console access to thin clients in exposed locations such as lobbies, clinical areas and production floors, and inspect any device that may have been accessed for signs of root-filesystem tampering or unexpected boot behavior. The public PoC (Zedeldi/CVE-2025-47827) can be used to verify whether devices still boot an unverified SquashFS image.