Patch Tuesday May 2025

Headlines

– Microsoft issued patches for 78 CVE-rated vulnerabilities, including five vulnerabilities already under exploit.

Scripting Engine Memory Corruption vulnerability

Microsoft DWM Core Library Elevation of Privilege vulnerability

There is a secure feature bypass issue within Windows Kerberos

Windows Common Log File System Driver Elevation of Privilege vulnerability

Windows Ancillary Function Driver for WinSock Elevation of Privilege vulnerability

Microsoft have also addressed some Critical-severity vulnerabilities however their commentary on these indicates that they have already been mitigated and that the CVEs are for information only.

Quorum Cyber Recommendations

Patching should be completed within your regular cycles and without delay. We do not at this time recommend expedited patching.

Microsoft Release Notes

May 2025 Security Updates – Release Notes – Security Update Guide – Microsoft

Key Vulnerability Details

Title	Scripting Engine Memory Corruption Vulnerability
CVE	CVE-2025-30397
CVSS	7.5
Reason for Concern	Exploited zero-day vulnerability.
Mitigations and other Factors	An attack requires a user to click on a crafted URL and then preparation of the target so that it uses Edge in Internet Explorer mode.
Commentary	This is listed as being a high complexity attack. While it has been exploited elsewhere, many factors have to be in place for this to happen again.
Threat Intelligence Comment	The Scripting Engine Memory Corruption Vulnerability (CVE-2025-30397), with a CVSS score of 7.5, is a notable concern due to its status as an exploited zero-day vulnerability. Despite its high complexity, if this vulnerability is exploited, attackers could gain significant control over affected systems, particularly if users are tricked into clicking on crafted URLs using Edge in Internet Explorer mode. Highlighting this is crucial to prevent potential breaches, as many factors must align for successful exploitation, but the impact could be severe if not properly mitigated.
Link	CVE-2025-30397 – Security Update Guide – Microsoft – Scripting Engine Memory Corruption Vulnerability

Title	Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVE	CVE-2025-30400
CVSS	7.8
Reason for Concern	Exploited zero-day vulnerability
Mitigations and other Factors	This is an elevation of privilege vulnerability so compromise of a user’s credentials is required before exploitation can happen.
Commentary	While this is an exploited Zero Day, other factors need to be in place before this can happen.
Threat Intelligence Comment	The Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVE-2025-30400), with a CVSS score of 7.8, poses a significant risk due to its exploitation as a zero-day vulnerability. Although exploitation requires prior compromise of user credentials, successful attacks could allow attackers to gain elevated privileges on affected systems. We highlight this vulnerability to stress the importance of safeguarding user credentials, as the potential impact of exploitation could lead to unauthorised access and control over critical system functions.
Link	CVE-2025-30400 – Security Update Guide – Microsoft – Microsoft DWM Core Library Elevation of Privilege Vulnerability

Title

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVV

CVE-2025-32701 and CVE-2025-32706

CVSS

7.8

Reason for Concern

Exploited zero-day vulnerability

Mitigations and other Factors

This is an elevation of privilege vulnerability so compromise of a user’s credentials is required before exploitation can happen.

Commentary

While this is an exploited Zero Day, other factors need to be in place before this can happen.

Threat Intelligence Comment

The Windows Common Log File System Driver Elevation of Privilege Vulnerabilities (CVE-2025-32701 and CVE-2025-32706), each with a CVSS score of 7.8, are exploited zero-day vulnerabilities. Although exploitation necessitates prior compromise of user credentials, these vulnerabilities could allow attackers to escalate privileges and gain unauthorised control over affected systems. Highlighting these vulnerabilities underscores the need to protect user credentials rigorously, as successful exploitation could lead to significant security breaches and unauthorised system access.

Link

CVE-2025-32701 – Security Update Guide – Microsoft – Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2025-32706 – Security Update Guide – Microsoft – Windows Common Log File System Driver Elevation of Privilege Vulnerability

Title	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE	CVE-2025-32709
CVSS	7.8
Reason for Concern	Exploited zero day vulnerability
Mitigations and other Factors	This is an elevation of privilege vulnerability so compromise of a user’s credentials is required before exploitation can happen.
Commentary	While this is an exploited Zero Day, other factors need to be in place before this can happen.
Threat Intelligence Comment	The Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2025-32709), with a CVSS score of 7.8, represents a significant threat as an exploited zero-day vulnerability. Although exploitation requires the prior compromise of user credentials, this vulnerability could enable attackers to escalate privileges and gain unauthorised access to system controls. Highlighting this vulnerability emphasises the importance of maintaining strong credential security, as successful exploitation could result in critical system breaches and unauthorised actions within affected systems.
Link	CVE-2025-32709 – Security Update Guide – Microsoft – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Title	Visual Studio Remote Code Execution Vulnerability
CVE	CVE-2025-32702
CVSS	7.8
Reason for Concern	This is a publicly disclosed zero-day vulnerability
Mitigations and other Factors	Local access to the target network is required, even though this is a remote code execution vulnerability.
Commentary	This one appears to be relatively difficult to exploit, given that the attacker needs to gain access to your network before they can do anything.
Threat Intelligence Comment	The Visual Studio Remote Code Execution Vulnerability (CVE-2025-32702), with a CVSS score of 7.8, is a publicly disclosed zero-day vulnerability that poses a serious threat. Although it requires local access to the target network for exploitation, successful attacks could allow remote code execution on affected systems. We highlight this vulnerability to underscore the need for robust network security, as attackers must first breach network before exploiting the vulnerability, which could otherwise lead to significant unauthorised actions and system compromise.
Link	CVE-2025-32702 – Security Update Guide – Microsoft – Visual Studio Remote Code Execution Vulnerability