Microsoft released security updates on March 2025 Patch Tuesday, addressing 57 vulnerabilities, including six classified as critical related to remote code execution. The vulnerabilities are categorized as follows: 23 Elevation of Privilege, 3 Security Feature Bypass, 23 Remote Code Execution, 4 Information Disclosure, 1 Denial of Service, and 3 Spoofing.
The updates specifically address six actively exploited zero-day vulnerabilities and one publicly disclosed zero-day vulnerability. The zero-day vulnerabilities include:
1. CVE-2025-24983 - Elevation of Privilege in Windows Win32 Kernel Subsystem.
2. CVE-2025-24984 - Information Disclosure in Windows NTFS.
3. CVE-2025-24985 - Remote Code Execution in Windows Fast FAT File System Driver.
4. CVE-2025-24991 - Information Disclosure in Windows NTFS.
5. CVE-2025-24993 - Remote Code Execution in Windows NTFS.
6. CVE-2025-26633 - Security Feature Bypass in Microsoft Management Console.
The publicly disclosed zero-day is:
- CVE-2025-26630 - Remote Code Execution in Microsoft Access.
A comprehensive list of resolved vulnerabilities includes various CVE IDs and their respective titles and severities, with several vulnerabilities affecting Microsoft Office products, Windows components, and Azure services.