Microsoft's Latest Update Patches 57 Security Vulnerabilities

Microsoft's released its monthly Patch Tuesday update for March 2025 to fix 57 bugs across Windows, Office, Azure, and other Microsoft systems. Seven of the patches address zero-day vulnerabilities, six of which have been actively exploited.

According to Bleeping Computer, this month's update fixes 23 elevation of privilege flaws, three security feature bypass flaws, 23 remote code execution flaws, four information disclosure flaws, one denial of service flaw, and three spoofing flaws. Microsoft also released patches to numerous vulnerabilities in Mariner and Microsoft Edge this month.

Patch Tuesday fixes for March

Seven of the flaws fixed were zero-day vulnerabilities, which allow bad actors to exploit systems before an official patch is released by developers. In this case, six of the seven zero-day vulnerabilities were actively exploited, while one was publicly exposed—so it's only a matter of time before actors exploit this seventh vulnerability, as well.

Two of the six active exploits (CVE-2025-24985 and CVE-2025-24993) are remote code execution vulnerabilities, through which attackers trick users into mounting a malicious VHD file to run code remotely. One affects the Windows Fast FAT System Driver, while the other is a flaw in Windows NTFS.

Two of the active exploits are information disclosure vulnerabilities, both in Windows NTFS. CVE-2025-24984 allows bad actors with physical access to a device to read memory and steal data when a malicious USB drive is inserted, while CVE-2025-24991 is exploited when a user mounts a malicious VHD file.

Finally, there's CVE-2025-24983, a vulnerability in the Windows Win32 Kernel Subsystem that allows local attackers to gain system privileges on a device, and CVE-2025-26633, a security feature bypass vulnerability in the Microsoft Management Console.

Microsoft says most of the exploited zero-days flaws were disclosed anonymously, though CVE-2025-24983 was identified by ESET and CVE-2025-26633 by Trend Micro.

The publicly disclosed zero-day—labeled CVE-2025-26630 and discovered by Unpatched.ai—allows remote code execution in Microsoft Office Access if the user opens a file sent via a phishing or social engineering attack. Microsoft also released patches for six other "critical" vulnerabilities affecting Microsoft Office, Remote Desktop Client, Windows Domain Name Service, Windows Remote Desktop Services, and Windows Subsystem for Linux Kernel.

How to install Microsoft's latest security updates

Microsoft releases its Patch Tuesday fixes on the second Tuesday of every month at 10 a.m. PT and pushes notifications and security updates to users if needed. Windows and Microsoft security updates generally download and install automatically on your PC. To ensure your PC is updated, go to Start > Settings > Windows Update, and select Check for Windows updates.

View the full article