Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
Summary: Microsoft's March 2025 security update covers 57 vulnerabilities, 6 of them rated critical, and Microsoft observed six being exploited in the wild: CVE-2025-26633 in the Management Console, CVE-2025-24984, CVE-2025-24991 and CVE-2025-24993 in Windows NTFS, CVE-2025-24985 in the Fast FAT driver, and CVE-2025-24983 in the win32 Kernel Subsystem. Two critical RD Gateway RCE flaws, CVE-2025-24035 and CVE-2025-24045, are unauthenticated use-after-free issues scored 8.1 and rated more likely to be exploited, while CVE-2024-9157 in a Synaptics Audio Effect Component service binary carries a CVSS score of 9.9.
What you should know: Six of these flaws were already being exploited before the patch, and the Synaptics named-pipe flaw at 9.9 could let even a remote unprivileged user load a malicious DLL into a service running on machines that received it through Windows Update.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-9157CVE-2025-24035CVE-2025-24045CVE-2025-24064CVE-2025-24084CVE-2025-24983CVE-2025-24984CVE-2025-24985CVE-2025-24991CVE-2025-24993CVE-2025-26633CVE-2025-26645
- Related
- Microsoft: 6 Zero-Days in March 2025 Patch Tuesday Cyber Risks ·CVE-2025-26633: Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability Known Exploited Vulnerabilities · Mar 11, 2025