Microsoft Patch Tuesday security updates for May 2025 fixed 5 actively exploited zero-days

Microsoft Patch Tuesday security updates for May 2025 addressed 75 security flaws across multiple products, including five zero-day flaws.

Microsoft Patch Tuesday security updates addressed 75 security vulnerabilities in Windows and Windows Components, Office and Office Components, .NET and Visual Studio, Azure, Nuance PowerScribe, Remote Desktop Gateway Service, and Microsoft Defender.

Of the flaws fixed by the company, 12 are rated Critical, and the rest is rated Important in severity. Microsoft confirmed that five zero-day vulnerabilities have been exploited in the wild.

“Of the patches released today, 12 are rated Critical, and the rest are rated Important in severity. This number of fixes isn’t unusual for May, but it does put Microsoft ahead of where they were at this point last year in regards to CVEs released. It’s also unusual to see so many Office-related bugs getting patched in a single month. Perhaps this is a harbinger of attacks we can expect to see later this year.” reads ZDI.

“Microsoft lists five bugs as being under active attack at the time of release, with two others being publicly known.”

The vulnerabilities actively exploited in the wild are:

• CVE-2025-30397 (CVSS score: 7.5) – Scripting Engine Memory Corruption Vulnerability
• CVE-2025-30400 (CVSS score: 7.8) – Microsoft Desktop Window Manager (DWM) Core Library Elevation of Privilege Vulnerability
• CVE-2025-32701 (CVSS score: 7.8) – Windows Common Log File System (CLFS) Driver Elevation of Privilege Vulnerability
• CVE-2025-32706 (CVSS score: 7.8) – Windows Common Log File System Driver Elevation of Privilege Vulnerability
• CVE-2025-32709 (CVSS score: 7.8) – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

–              CVE-2025-30397 – Scripting Engine Memory Corruption Vulnerability

Attackers can exploit a remote code execution bug in Edge by tricking victims into clicking a crafted link. The bug forces Edge to switch into Internet Explorer mode.

–              CVE-2025-32701/CVE-2025-32706 – Windows Common Log File System Driver Elevation of Privilege Vulnerability

Recent Windows component bugs, previously exploited, enable SYSTEM-level privilege escalation and may support ransomware attacks.

–              CVE-2025-32709 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
The researchers observed that this component was exploited again after February, raising concerns about patch quality. An attacker can exploit this flaw to achieve privilege escalation to SYSTEM.

–              CVE-2025-30400 – Microsoft DWM Core Library Elevation of Privilege Vulnerability
This recently exploited privilege escalation bug, patched again, allows SYSTEM-level code execution. The researchers warn that the flaw could be exploited in phishing/ransomware attacks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Patch Tuesday)