Microsoft Patch Tuesday for September 2025 – Snort rules and prominent vulnerabilities
Summary: Microsoft's September 2025 security update covers 86 vulnerabilities, none of which Microsoft observed being exploited in the wild, though it assessed exploitation as likely for eight, including one remote code execution flaw, CVE-2025-54916, a stack-buffer overflow in Windows NTFS that lets an authorized attacker execute code over the network. Other highlighted flaws include CVE-2025-54910, a heap-based buffer overflow in Microsoft Office allowing local code execution, CVE-2025-54918, an improper authentication issue in Windows NTLM that lets an authorized attacker gain SYSTEM privileges over a network, and CVE-2025-54101, a use-after-free in Windows SMB v3 requiring a race condition to win.
What's compelling: Eight flaws are flagged as likely to be exploited even though none have been seen in the wild yet, and one of them, the NTLM authentication flaw CVE-2025-54918, lets an authorized attacker reach SYSTEM privileges across the network on Windows 10, 11, and Server 2008 through 2025.