Security Digest (March 2025)

The 2nd Tuesday of every month is Patch Tuesday! Every Patch Tuesday, Microsoft addresses security vulnerabilities in their products via a large deployment of software updates. This month’s Patch Tuesday addressed 64 security vulnerabilities. The full list can be seen here.

This month’s leading risk types are Remote Code Execution and Elevation Of Privilege (40%) followed by Information Disclosure (7%) and Spoofing (5%).

Threat Grading Overview
Microsoft assesses threats based on the theoretical worst possible outcome were a vulnerability to be exploited. The assessment factors in how easily a vulnerability can be exploited, and what damage could be done.

These patches included remediation for seven “Zero-Day” vulnerabilities, meaning no patch was previously available.  All of these vulnerabilities are being actively exploited in the wild.

CVE-2025-24983 – Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Microsoft says this vulnerability will allow local attackers to gain SYSTEM privileges on the device after winning a race condition.

Microsoft has not shared how the flaw was exploited in attacks.

CVE-2025-24984 – Windows NTFS Information Disclosure Vulnerability

Microsoft says that this flaw can be exploited by attackers who have physical access to the device and insert a malicious USB drive.

Exploiting the flaw allows the attackers to read portions of heap memory and steal information.

Microsoft says that this vulnerability was disclosed anonymously.

CVE-2025-24985 – Windows Fast FAT File System Driver Remote Code Execution Vulnerability

Microsoft says that this remote code execution vulnerability is caused by an integer overflow or wraparound in Windows Fast FAT Driver that, when exploited, allows an attacker to execute code.

“An attacker can trick a local user on a vulnerable system into mounting a specially crafted VHD that would then trigger the vulnerability,” explains Microsoft.

While Microsoft has not shared details about how it was exploited but malicious VHD images were previously distributed in phishing attacks and through pirated software sites.

Microsoft says that this vulnerability was disclosed anonymously.

CVE-2025-24991 – Windows NTFS Information Disclosure Vulnerability

Microsoft says that attackers can exploit this flaw to read small portions heap memory and steal information.

Attackers can exploit the flaw by tricking a user into mounting a malicious VHD file.

Microsoft says that this vulnerability was disclosed anonymously.

CVE-2025-24993 – Windows NTFS Remote Code Execution Vulnerability

Microsoft says that this remote code execution vulnerability is caused by a heap-based buffer overflow bug in Windows NTFS that allows an attacker to execute code.

“An attacker can trick a local user on a vulnerable system into mounting a specially crafted VHD that would then trigger the vulnerability,” explains Microsoft

Microsoft says that this vulnerability was disclosed anonymously.

CVE-2025-26633 – Microsoft Management Console Security Feature Bypass Vulnerability

While Microsoft has not shared any details about this flaw, based on its description, it may involve a bug that allows malicious Microsoft Management Console (.msc) files to bypass Windows security features and execute code.

“In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability,” explains Microsoft.

“In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker’s site or send a malicious attachment.”

One zero day is publicly exposed, meaning steps are available to reproduce the vulnerability. Details on this vulnerability can be seen below:

CVE-2025-26630 – Microsoft Access Remote Code Execution Vulnerability

Microsoft says this remote code execution flaw is caused by a use after free memory bug in Microsoft Office Access.

To exploit the flaw, a user must be tricked into opening a specially crafted Access file. This can be done through phishing or social engineering attacks.

However, the flaw cannot be exploited through the preview pane. Microsoft reports the flaw was discovered by Unpatched.ai.