Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws

These days is Microsoft’s March 2025 Patch Tuesday, which incorporates safety updates for 57 flaws, together with six actively exploited zero-day vulnerabilities.

This Patch Tuesday additionally fixes 3 “Important” vulnerabilities, all far flung code execution vulnerabilities.

The selection of insects in each and every vulnerability class is indexed underneath:

• 23 Elevation of Privilege Vulnerabilities
• 3 Safety Characteristic Bypass Vulnerabilities
• 23 Far flung Code Execution Vulnerabilities
• 4 Knowledge Disclosure Vulnerabilities
• 1 Denial of Carrier Vulnerabilities
• 3 Spoofing Vulnerabilities

The above numbers don’t come with Mariner flaws and 10 Microsoft Edge vulnerabilities fastened previous this month.

To be informed extra concerning the non-security updates launched lately, you’ll evaluation our devoted articles at the Home windows 11 KB5053598 & KB5053602 cumulative updates.

Six actively exploited zero-days

This month’s Patch Tuesday fixes six actively exploited zero-days and person who was once publicly uncovered, for a complete of 7 zero-days.

Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited whilst no legitimate repair is to be had.

A number of the actively exploited 0 days are associated with Home windows NTFS insects that contain mounting VHD drives.

The actively exploited zero-day vulnerability in lately’s updates are:

CVE-2025-24983 – Home windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Microsoft says this vulnerability will permit native attackers to achieve SYSTEM privileges at the software after profitable a race situation.

Microsoft has no longer shared how the flaw was once exploited in assaults. On the other hand, because it was once came upon by way of Filip Jurčacko with ESET, we will be able to most likely be told extra in a long term file.

BleepingComputer contacted ESET for more info about this flaw.

CVE-2025-24984 – Home windows NTFS Knowledge Disclosure Vulnerability

Microsoft says that this flaw will also be exploited by way of attackers who’ve bodily get entry to to the software and insert a malicious USB force.

Exploiting the flaw lets in the attackers to learn parts of heap reminiscence and thieve knowledge.

Microsoft says that this vulnerability was once disclosed anonymously.

CVE-2025-24985 – Home windows Speedy FAT Report Machine Motive force Far flung Code Execution Vulnerability

Microsoft says that this far flung code execution vulnerability is brought about by way of an integer overflow or wraparound in Home windows Speedy FAT Motive force that, when exploited, lets in an attacker to execute code.

“An attacker can trick a neighborhood person on a susceptible machine into mounting a specifically crafted VHD that may then cause the vulnerability,” explains Microsoft.

Whilst Microsoft has no longer shared information about the way it was once exploited however malicious VHD photographs have been in the past allotted in phishing assaults and thru pirated tool websites.

Microsoft says that this vulnerability was once disclosed anonymously.

CVE-2025-24991 – Home windows NTFS Knowledge Disclosure Vulnerability

Microsoft says that attackers can exploit this flaw to learn small parts heap reminiscence and thieve knowledge.

Attackers can exploit the flaw by way of tricking a person into mounting a malicious VHD record.

Microsoft says that this vulnerability was once disclosed anonymously.

CVE-2025-24993 – Home windows NTFS Far flung Code Execution Vulnerability

Microsoft says that this far flung code execution vulnerability is brought about by way of a heap-based buffer overflow computer virus in Home windows NTFS that permits an attacker to execute code.

“An attacker can trick a neighborhood person on a susceptible machine into mounting a specifically crafted VHD that may then cause the vulnerability,” explains Microsoft

Microsoft says that this vulnerability was once disclosed anonymously.

CVE-2025-26633 – Microsoft Control Console Safety Characteristic Bypass Vulnerability

Whilst Microsoft has no longer shared any information about this flaw, in response to its description, it should contain a computer virus that permits malicious Microsoft Control Console (.msc) recordsdata to circumvent Home windows safety features and execute code.

“In an e mail or rapid message assault situation, the attacker may just ship the centered person a specifically crafted record this is designed to take advantage of the vulnerability,” explains Microsoft.

“Finally an attacker would don’t have any technique to power a person to view attacker-controlled content material. As a substitute, an attacker must persuade a person to do so. As an example, an attacker may just trap a person to both click on a hyperlink that directs the person to the attacker’s web site or ship a malicious attachment.”

Microsoft says Aliakbar Zahravi from Development Micro came upon this flaw. BleepingComputer contacted Development Micro to be told extra about how this flaw was once exploited.

The publicly disclosed zero-day is:

CVE-2025-26630 – Microsoft Get admission to Far flung Code Execution Vulnerability

Microsoft says this far flung code execution flaw is brought about by way of a use after loose reminiscence computer virus in Microsoft Place of business Get admission to.

To milk the flaw, a person should be tricked into opening a specifically crafted Get admission to record. This will also be completed via phishing or social engineering assaults.

On the other hand, the flaw can’t be exploited during the preview pane.

Microsoft has no longer shared who disclosed this flaw.

Fresh updates from different corporations

Different distributors who launched updates or advisories in March 2025 come with:

The March 2025 Patch Tuesday Safety Updates

Underneath is your complete record of resolved vulnerabilities within the March 2025 Patch Tuesday updates.

To get entry to the whole description of each and every vulnerability and the techniques it impacts, you’ll view the complete file right here.