Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws

Source: BleepingComputer Author: Lawrence Abrams URL: https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2025-patch-tuesday-fixes-exploited-zero-day-134-flaws/

ONE SENTENCE SUMMARY:

Microsoft’s June 2025 security update addresses critical and important vulnerabilities across Office, Windows, Edge, Azure, and developer tools.

MAIN POINTS:

  1. Over 100 vulnerabilities were disclosed across Microsoft products in June 2025, many rated as Important or Critical.
  2. Microsoft Office, especially Excel and Word, includes multiple Critical remote code execution (RCE) vulnerabilities.
  3. Windows Remote Desktop Services and Kerberos have Critical vulnerabilities allowing remote code execution and privilege escalation.
  4. Several Edge (Chromium-based) flaws involve improper implementation and remote code execution vulnerabilities.
  5. Windows Kernel and NTFS face multiple Elevation of Privilege and Information Disclosure vulnerabilities.
  6. Azure-related services, including Local Cluster and Admin Center, are affected by privilege and information disclosure issues.
  7. Visual Studio and related tools include elevation of privilege vulnerabilities that could affect developer environments.
  8. Windows Media and Telephony Services have multiple RCE vulnerabilities rated as Important.
  9. Windows Subsystem for Linux and BitLocker contain security feature bypass vulnerabilities.
  10. Numerous Denial of Service vulnerabilities exist in Windows components like HTTP.sys, Standards-Based Storage, and MSMQ.

TAKEAWAYS:

  1. Patch Microsoft Office immediately due to multiple Critical remote code execution vulnerabilities in Excel and Word.
  2. Prioritize updates for Windows Remote Desktop Services and Kerberos due to high-risk remote exploits.
  3. Edge browser vulnerabilities highlight the ongoing need for Chromium-based patching and scrutiny.
  4. Elevation of Privilege remains a dominant vulnerability type, affecting kernel, NTFS, and various Windows services.
  5. Regular patching of Azure, Visual Studio, and developer tools is essential to maintain secure development environments.