May 2025 Patch Tuesday Updates Fix 5 Zero-Day Vulnerabilities

Microsoft has rolled out the May 2025 Patch Tuesday updates, delivering not only the routine security fixes but also several notable quality enhancements for Windows 11 and Windows 10. This month’s release includes an impressive 74 patches addressing vulnerabilities across Windows and its components, Office, Azure, Remote Desktop Gateway Service, Microsoft Defender, and more.

On the quality and experience updates front, Microsoft has rolled out the KB5058411 patch for Windows 11 version 24H2, which brings AI-powered Recall and Click to Do features for Copilot+ PCs. On Windows 11 version 23H2, the KB5058405 update adds new pivot-based curated views in File Explorer Home, improved performance with ZIP files, and enhanced support for text scaling.

74 vulnerabilities fixed in the May 2025 Patch Tuesday updates

This month, Microsoft has patched 12 critical vulnerabilities and the rest are rated Important in severity. The company has warned that five vulnerabilities are under attack right now targeting Windows 10 and 11 PCs as well as Windows Server machines. Let’s take a look at the most important vulnerabilities Microsoft fixed in the May 2025 Patch Tuesday updates.

• CVE-2025-30397: This is a Scripting Engine memory-corruption vulnerability with a CVSS score of 7.5. This bug could enable unauthorized attackers to execute remote code execution attacks on unpatched systems.
• CVE-2025-30400: This is an elevation of privilege vulnerability in the Microsoft Desktop Window Manager (DWM) Core Library. This security flaw affects Windows 11, Windows 10, Windows Server 2016, and newer versions of the server OS.
• CVE-2025-32701 and CVE-2025-32706: These are Windows Common Log File System Driver elevation-of-privilege vulnerabilities with a 7.8 CVSS score. Attackers could exploit these vulnerabilities to locally takeover a device and perform unauthorized actions.
• CVE-2025-32702: This is a remote-code execution vulnerability that affects Visual Studio 2019 and 2022.
• CVE-2025-32709: This is a Windows Ancillary Function driver for Winsock elevation-of-privilege vulnerability with a CVSS score of 7.8. It could enable threat actors to trigger the exploit and gain administrator-level privileges on targeted devices.
• CVE-2025-29972: This is a critical Server-Side Request Forgery (SSRF) vulnerability affecting Microsoft Azure, specifically within the Azure Storage Resource Provider.
• CVE-2025-29827: This flaw allows cybercriminals to launch elevation of privilege attacks against Azure Automation.

You can find below the full list of CVEs included in this month’s Patch Tuesday:

Quality and experiences updates

If you’re running Windows 11 version 24H2, the KB5058411 update enables the AI-powered Windows Recall and Click to Do features on Copilot+ PCs. It also brings the new AI-based search experience on AMD and Intel models. Moreover, this release introduces a new Phone Link sidebar for the Start menu, a new Speech recap feature for Narrator, as well as pivot-based curated views in File Explorer Home, and more. These enhancements are also available for users running Windows 11 version 23H2.

For Windows 10 version 22H2, this update brings a couple of security improvements to internal Windows OS functionality. It also includes new blocklist drivers with security vulnerabilities that have been exploited by attackers in Bring Your Own Vulnerable Driver (BYOVD) attacks.

Windows Update testing and best practices

Organizations looking to deploy this month’s patches should conduct thorough testing before deploying them widely on production systems. That said, applying the patches widely shouldn’t be delayed longer than necessary as hackers start to work out how to weaponize newly reported vulnerabilities.

A best practice is to make sure you have backed up systems before applying updates. Every month, users experience issues with Windows updates that lead to systems not booting, application and hardware compatibility issues, or even data loss in extreme cases.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.