Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities

Summary: Microsoft's May 2025 security update covers 78 vulnerabilities, 11 of them rated critical, with five observed exploited in the wild. The exploited flaws include CVE-2025-30397, a remote code execution bug in the Microsoft Scripting Engine, and four elevation of privilege vulnerabilities (CVE-2025-32709, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706) in the Ancillary Function Driver for WinSock, the DWM Core Library and the Windows Common Log File System Driver.
Key Takeaway: CVE-2025-30386, a Microsoft Office RCE with a CVSS base score of 8.3, can be triggered by an email the victim never clicks, views or interacts with, and Microsoft rates both attack complexity and exploitation likelihood as low and more likely respectively. Five of this month's flaws are already being exploited, so the patch window is not theoretical.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-29833 CVE-2025-29966 CVE-2025-29967 CVE-2025-30377 CVE-2025-30386 CVE-2025-30390 CVE-2025-30397 CVE-2025-30398 CVE-2025-30400 CVE-2025-32701 CVE-2025-32706 CVE-2025-32709
Related: Patch Tuesday, May 2025 Edition Cyber Risks ·
Microsoft and Adobe Patch Tuesday, May 2025 Security Update Review | Qualys Cyber Risks ·
CVE-2025-30400: Microsoft Windows DWM Core Library Use-After-Free Vulnerability Known Exploited Vulnerabilities · May 13, 2025