Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-24521 | Out-of-bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 7% | KEVRansomware | KEV |
| CVE-2022-37969 | Out-of-bounds write flaw in Microsoft Windows CLFS driver enables privilege escalation | 7.8 | 28% | KEVRansomware | KEV |
| CVE-2023-23376 | Out-of-Bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 11% | KEVRansomware | KEV |
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation | 7.8 | 49% | KEVRansomwarePoC | KEV |
| CVE-2024-49138 | Local Privilege Escalation via Heap Overflow in Microsoft Windows CLFS Driver | 7.8 | 26% | KEVPoC ×2 | KEV |
CVE-2025-26670+4 related CVEs | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network | 8.1 group max | 11% | ||
| CVE-2025-27480 | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network | 8.1 | 12% | ||
| CVE-2025-27482 | Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network | 8.1 | 2% | ||
CVE-2025-27745+4 related CVEs | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally | 7.8 | 1% | ||
| CVE-2025-29824 | Use-After-Free Privilege Escalation in Microsoft Windows CLFS Driver (Actively Exploited) | 7.8 | 19% | KEVRansomwarePoC ×2 | KEV |
From the original article
4 min read at thehackernews.com
Ravie Lakshmanan Apr 09, 2025 Endpoint Security / Vulnerability Microsoft has released security fixes to address a massive set of 125 flaws affecting its software products, including one vulnerability that it said has been actively exploited in the wild. Of the 125 vulnerabilities, 11 are rated Critical, 112 are rated Important, and two are rated Low in severity.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.