Patch Tuesday Summary October 2025

Headlines

Microsoft issued patches for 175 CVE-rated vulnerabilities.

Two publicly disclosed Zero-Day vulnerabilities
Six Zero-Day vulnerabilities
End of life for Windows 10
80 Elevation of Privilege Vulnerabilities
11 Security Feature Bypass Vulnerabilities
31 Remote Code Execution Vulnerabilities
28 Information Disclosure Vulnerabilities
11 Denial of Service Vulnerabilities
10 Spoofing Vulnerabilities

Quorum Cyber Recommendations

Patching should be completed within your regular cycles and without delay. We do not recommend expedited patching at this time.

Microsoft Release Notes

October 2025 Security Updates – Release Notes – Security Update Guide – Microsoft

Overview

Microsoft’s October 2025 Patch Tuesday addressed 172–193 vulnerabilities, including 6 zero-days and 9 critical flaws. It also marked the end of free security updates for Windows 10.

Here is a detailed breakdown of the key highlights from October 2025 Patch Tuesday:

Vulnerability Overview

Total vulnerabilities patched: Between 172 and 193, depending on the source
Zero-day vulnerabilities: 6 total, with 2 actively exploited in the wild
Critical severity flaws: 8 to 9, including remote code execution (RCE), elevation of privilege, and spoofing vulnerabilities

Notable Zero-Day Fixes

CVE-2025-24990: Elevation of privilege in the Agere Modem driver, actively exploited. Microsoft removed the vulnerable driver entirely
CVE-2025-59230: Elevation of privilege in Windows Remote Access Connection Manager
CVE-2025-59287: RCE vulnerability in Windows Server Update Services (WSUS) with a CVSS score of 9.8

Actively Exploited & Publicly Known Flaws

3 vulnerabilities were confirmed under active attack before patch release
3 others were publicly disclosed, increasing the risk of exploitation

End of Windows 10 Support

October 2025 marks the final free Patch Tuesday for Windows 10
- Users must now opt into Extended Security Updates (ESU):
  - 1 year for consumers
  - Up to 3 years for enterprises

Affected Products

Patches span across:
- Windows OS (10, 11, Server editions)
- Microsoft Office
- Azure services
- Third-party drivers bundled with Windows

Key Takeaways for IT Admins

Prioritise patching systems vulnerable to the actively exploited zero-days
Review systems for legacy components like the Agere Modem driver
Plan migration strategies for Windows 10 systems or enroll in ESU programs

Key Vulnerability Details

Title	Windows Agere Modem Driver Elevation of Privilege Vulnerability
CVE	CVE-2025-24990
CVSS	7.8
Reason for Concern	Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows.
Mitigations and other factors	Driver Removal: Microsoft has removed the vulnerable ltmdm64.sys driver in the October 2025 cumulative update. This update disables the driver entirely, rendering any dependent fax modem hardware non-functional. Hardware Deprecation: Users and organisations should remove any existing dependencies on fax modem hardware that relies on this driver. This includes: Replacing legacy hardware with modern alternatives.
Commentary	CVE-2025-24990 (CVSS 7.8) is mitigated by Microsoft’s removal of the vulnerable ltmdm64.sys driver in the October 2025 update. Ensure this update is applied and retire any legacy fax modem hardware that depends on the deprecated driver.
Threat Intelligence Comment	Microsoft’s removal of the vulnerable ltmdm64.sys Agere Modem driver (CVE-2025-24990, CVSS 7.8) addresses an elevation of privilege risk inherent in legacy fax modem components. While this mitigates the immediate threat, it effectively deprecates affected hardware. Organisations should phase out any remaining modem dependencies and ensure the October 2025 cumulative update is deployed promptly.
Link	CVE-2025-24990 – Security Update Guide – Microsoft – Windows Agere Modem Driver Elevation of Privilege Vulnerability

Title

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

CVE

CVE-2025-59230

CVSS

7.8

Reason for Concern

Improper access control in Windows Remote Access Connection Manager allows an authorised attacker to elevate privileges locally.

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Mitigations and other factors

Apply the October 2025 Patch: Microsoft released a fix on October 14, 2025, as part of its monthly security roll-up. This update corrects the access control flaw in RasMan.

Commentary

Attackers must “invest in some measurable amount of effort in preparation or execution” to successfully exploit the flaw.

Threat Intelligence Comment

CVE-2025-59230 (CVSS 7.8) impacts the Windows Remote Access Connection Manager (RasMan) through improper access control, enabling local privilege escalation to SYSTEM. While exploitation requires moderate effort, successful attacks could grant full system control. Organisations should apply the October 2025 Patch immediately to remediate this flaw and reduce potential lateral movement risks.

Link

CVE-2025-59230 – Security Update Guide – Microsoft – Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Title	Secure Boot bypass in IGEL OS before 11
CVE	CVE-2025-47827
CVSS	4.6
Reason for Concern	In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image. An attacker who successfully exploited this vulnerability could bypass Secure Boot.
Mitigations and other factors	Upgrade to IGEL OS 11 or later: IGEL OS 11 includes updated boot chain validation and fixes the signature verification flaw. Legacy IGEL OS 10 images are vulnerable and should be retired immediately. Rebuild and re-sign boot images: Ensure all boot artifacts (bootloader, kernel, initrd, rootfs) are cryptographically signed using trusted keys.
Commentary	Enforce Secure Boot with updated UEFI firmware: Verify that Secure Boot is enabled and functioning correctly in the system’s UEFI settings. Apply the latest firmware updates from your hardware vendor to address known UEFI vulnerabilities. Audit thin-client deployments: Identify systems still running IGEL OS 10 and prioritise them for upgrade or decommissioning. Review boot-time trust chains and ensure no unverified components are loaded. Monitor for exploitation indicators: Look for unauthorised changes to boot images or unexpected root filesystem mounts. Use endpoint detection tools to flag anomalies during early boot phases.
Threat Intelligence Comment	CVE-2025-47827 (CVSS 4.6) affects IGEL OS versions prior to 11, where improper signature verification in the igel-flash-driver module allows Secure Boot to be bypassed. While exploitation requires physical or low-level system access, it undermines boot integrity and trust. Upgrading to IGEL OS 11 or later is essential, along with enforcing Secure Boot and re-signing all boot components to ensure a validated, tamper-resistant startup chain.
Link	CVE-2025-47827 – Security Update Guide – Microsoft – MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11

Title	RMP Corruption During SNP Initialization
CVE	CVE-2025-0033
CVSS	8.2
Reason for Concern	CVE-2025-0033 is a vulnerability in AMD EPYC processors using Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP). It involves a race condition during Reverse Map Table (RMP) initialisation that could allow a malicious or compromised hypervisor to modify RMP entries before they are locked, potentially impacting the integrity of SEV-SNP guest memory. This issue does not expose plaintext data or secrets and requires privileged control of the hypervisor to exploit. Across Azure Confidential Computing products, multiple security guardrails are in place to prevent host compromise, combining isolation, integrity verification and continuous monitoring. All host operations follow audited and approved management pathways, with administrative access strictly controlled, limited and logged. Together, these protections reduce the risk of host compromise or unauthorised memory manipulation, helping ensure that confidential workloads and customer VMs maintain their confidentiality and integrity on Azure hosts.
Mitigations and other factors	Updates to mitigate this vulnerability in Azure Confidential Computing’s (ACC) AMD-based clusters are being developed but are not yet complete. Once complete, the updates with be deployed across all AMD-based infrastructure and customers will be notified via Azure Service Health Alerts if they are required to reboot their ACC resources. The Security Updates table for this CVE will be updated immediately upon availability of the mitigated versions for any affected ACC product SKUs. Additionally, customers who have subscribed to the Security Update Guide will be notified when this CVE is revised to indicate updates are available. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this CVE. “Across Azure Confidential Computing products, multiple security guardrails are in place to prevent host compromise, combining isolation, integrity verification and continuous monitoring. All host operations follow audited and approved management pathways, with administrative access strictly controlled, limited and logged. Together, these protections reduce the risk of host compromise or unauthorised memory manipulation, helping ensure that confidential workloads and customer VMs maintain their confidentiality and integrity on Azure hosts.”
Commentary	CVE-2025-0033 (CVSS 8.2) impacts AMD EPYC processors using SEV-SNP due to a race condition that could let a privileged hypervisor modify memory mappings. While exploitation requires elevated access, it poses integrity risks to guest memory.
Threat Intelligence Comment	CVE-2025-0033 affects AMD EPYC processors using SEV-SNP, where a race condition during Reverse Map Table initialisation could allow a privileged hypervisor to alter RMP entries before locking. While this flaw does not expose plaintext data, it threatens guest memory integrity in virtualised environments. Azure’s strong isolation, auditing, and continuous monitoring mitigate risk, and Microsoft is developing updates for AMD-based Confidential Computing clusters to address the issue.
Link	CVE-2025-0033 – Security Update Guide – Microsoft – AMD CVE-2025-0033: RMP Corruption During SNP Initialization

Title	Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
CVE	CVE-2025-2884
CVSS	5.3
Reason for Concern	CVE-2025-2884 is regarding a vulnerability in TCG TPM2.0 Reference implementation’s CryptHmacSign helper function that is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key’s algorithm. CERT/CC created this CVE on their behalf. The documented Windows updates incorporate updates in TCG TPM2.0 Reference implementation which address this vulnerability.
Mitigations and other factors	Update TPM Firmware: Vendors using the TCG reference implementation must release updated firmware that incorporates fixes from Errata Revision 1.83 and TCGVRT0009 advisory. End users should check with their hardware manufacturers for firmware updates and apply them promptly.
Commentary	Validate TPM Implementations: Ensure that TPM 2.0 modules strictly validate cryptographic parameters, especially signature schemes and key algorithms. Use formal verification tools or third-party audits to confirm compliance with TCG standards. Monitor Supply Chain Dependencies: Identify systems that rely on TPM firmware derived from the TCG reference code. Work with vendors to confirm whether their products are affected and what remediation steps are available. Apply Input Validation Best Practices: Assume all inputs to TPM modules are potentially malicious. Use a whitelist-based validation strategy to accept only known-good inputs that conform to strict specifications.
Threat Intelligence Comment	CVE-2025-2884 (CVSS 5.3) affects the TCG TPM 2.0 reference implementation due to insufficient validation in the CryptHmacSign helper, leading to an Out-of-Bounds read. Although the impact is moderate, it could compromise the reliability of cryptographic operations in affected TPM firmware. Vendors should apply updates from Errata 1.83 and TCGVRT0009, and organisations must ensure their TPM firmware is validated and fully patched to maintain platform integrity.
Link	CVE-2025-2884 – Security Update Guide – Microsoft – Cert CC: CVE-2025-2884 Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation

Threat Intelligence