Microsoft’s May Patch Tuesday Fixes Security Vulnerabilities, Including Actively Exploited Ones

Microsoft’s May 2025 Patch Tuesday updates have just rolled out, delivering critical security patches for a range of vulnerabilities across various Microsoft products.

These updates address dozens of vulnerabilities in total, including ones with high severity score (based on Common Vulnerability Scoring System) and risk for active exploitation. This means it’s crucial for both home users and businesses to apply these updates as soon as possible to keep systems secure.

Each month, Microsoft releases important updates to address security flaws in its software. For May 2025, the company patched over 70 vulnerabilities for products including:

• Windows Operating Systems (Windows 10, Windows 11)
• Windows Server (for enterprise environments)
• Microsoft Office (including Word, Excel, PowerPoint)
• Microsoft 365 Services (including Outlook, OneDrive, Teams)
• Visual Studio 2017, 2019, 2022, Visual Studio Code

These updates are essential to protect your systems from cyberattacks that could compromise your data, give attackers control of your device, or even lead to a data breach.

Key Vulnerabilities Addressed

Among the vulnerabilities patched, several are of particular concern:

• CVE-2025-26685: Microsoft Defender Identity Spoofing Vulnerability
  This vulnerability in Microsoft Defender allows unauthorized access via identity spoofing letting an attacker act as another account on the network.
• CVE-2025-30400: Microsoft Windows DWM Core Library Use-After-Free Vulnerability
  This vulnerability in the Windows DWM Core Library allows an authorized attacker to escalate privileges locally, potentially giving them SYSTEM-level access. If exploited, this could allow an attacker to take full control of the system.
• CVE-2025-30397: Microsoft Windows Scripting Engine Type Confusion Vulnerability
  A type confusion issue in the Microsoft Scripting Engine allows an attacker to execute code remotely over a network. By exploiting this flaw, attackers could potentially execute malicious code simply by tricking a user into interacting with a specially crafted URL in a browser like Microsoft Edge or Internet Explorer.
• CVE-2025-32701: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
  A flaw in the Windows CLFS Driver allows an attacker to escalate privileges to SYSTEM level locally, where If exploited could lead to unauthorized access and control over critical system functions.
• CVE-2025-32702: Visual Studio Remote Code Execution Vulnerability
  A critical vulnerability in Visual Studio allows unauthenticated attackers to execute local code on the system. This flaw, if exploited, could give an attacker control over a vulnerable machine.
• CVE-2025-32706: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
  A heap-based buffer overflow in the Windows CLFS Driver can allow attackers to elevate their privileges locally to SYSTEM level. This vulnerability has the potential to cause significant system damage if exploited.
• CVE-2025-32709: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
  This vulnerability in the Windows Ancillary Function Driver for WinSock allows attackers to escalate privileges to administrator level. Exploiting this issue could give unauthorized users control over sensitive system resources.

Several of these vulnerabilities are actively being targeted by attackers. This means hackers are already trying to exploit these weaknesses to gain unauthorized access or control over systems. Some of these actively exploited vulnerabilities include flaws in the Windows Kernel and Microsoft Office applications. If left unpatched, these vulnerabilities could be used to gain access to sensitive data, compromise systems, or launch attacks against business infrastructure.

Whether you’re a home user or managing an entire business network, installing these security patches should be a top priority. Some of these vulnerabilities are actively being used in attacks. If you delay applying the updates, you risk exposing your systems to security breaches, such as vulnerabilities like those in Microsoft Exchange Server which could allow remote code execution where an attacker could take over a server or gain unauthorized access to personal or business-critical data or vulnerabilities in Windows or Office products which could expose your personal devices and their data.

For Home Users:

Enable automatic updates or if unable to (such as metered internet connection), manually check for updates. Go to the “Settings app (right-click Windows icon or click then search Settings) >> Update & Security >> Windows Update and click “Check for updates” to ensure your system has installed the latest fixes.

For Businesses:

• Patch management is key, which allows patching of vulnerabilities with testing prior to deployment across your network. Prioritize these updates, especially those addressing vulnerabilities that are being actively exploited. Make sure to test updates on a few systems first to ensure compatibility, then deploy across your network. Workstations can be set for automatic patching to save time and reduce security risks. Critical systems and servers (when properly secured) should have updates reviewed before deployment to avoid issues.
• Regular Updating and Review: Make updating/patching a regular part of your digital cyber security strategy. Microsoft’s Patch Tuesday updates are released monthly, and staying on top of these updates is important for maintaining the security of your devices and/or organization.

Stay Protected, Stay Updated

Whether you’re an individual or managing an organization, applying these patches ensures that you’re taking the necessary steps to protect your data and prevent potential security breaches.

For detailed information on the updates, you can visit Microsoft’s official security update guide. Apply these updates as soon as possible now to keep your devices and networks secure.