Microsoft's security release of 11 March 2025
Patch Tuesday, March 2025
As of , CISA lists seven of the 57 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-24054, NTLM Hash Disclosure Spoofing.
On CISA's list of exploited vulnerabilities
- CVE-2025-24054NTLM Hash Disclosure Spoofing. Listed by CISA on 17 April 2025, 37 days after the release
- CVE-2025-26633Microsoft Management Console Security Feature Bypass. Listed by CISA on 11 March 2025, release day
- CVE-2025-24985Windows Fast FAT File System Driver Remote Code Execution. Listed by CISA on 11 March 2025, release day
- CVE-2025-24993Windows NTFS Remote Code Execution. Listed by CISA on 11 March 2025, release day
- CVE-2025-24984Windows NTFS Information Disclosure. Listed by CISA on 11 March 2025, release day
- CVE-2025-24991Windows NTFS Information Disclosure. Listed by CISA on 11 March 2025, release day
- CVE-2025-24983Windows Win32 Kernel Subsystem Elevation of Privilege. Listed by CISA on 11 March 2025, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 57 CVEs |
| On CISA's list of exploited vulnerabilities | 7 CVEs |
| CISA's SSVC exploitation: active | 7 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 50 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | none |
| EPSS 0.10 or more | 3 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-24054NTLM Hash Disclosure Spoofing | Active | Patch this weekListed | 6.5 Medium | 0.59 |
| 2 | CVE-2025-26633Microsoft Management Console Security Feature Bypass | Active | Patch this weekListed | 7.0 High | 0.30 |
| 3 | CVE-2025-24985Windows Fast FAT File System Driver Remote Code Execution | Active | Patch soonListed | 7.8 High | 0.04 |
| 4 | CVE-2025-24993Windows NTFS Remote Code Execution | Active | Patch soonListed | 7.8 High | 0.02 |
| 5 | CVE-2025-24984Windows NTFS Information Disclosure | Active | Patch soonListed | 4.6 Medium | 0.02 |
| 6 | CVE-2025-24991Windows NTFS Information Disclosure | Active | Patch soonListed | 5.5 Medium | 0.02 |
| 7 | CVE-2025-24983Windows Win32 Kernel Subsystem Elevation of Privilege | Active | Patch soonListed | 7.0 High | 0.01 |
| 8 | CVE-2025-24071Microsoft Windows File Explorer Spoofing | None | Not on CISA's list | 6.5 Medium | 0.23 |
| 9 | CVE-2025-26645Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.03 |
| 10 | CVE-2025-24076Microsoft Windows Cross Device Service Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.03 |
| 11 | CVE-2025-21247MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.03 |
| 12 | CVE-2025-24056Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 13 | CVE-2025-24035Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.02 |
| 14 | CVE-2025-24051Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 15 | CVE-2025-24084Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 16 | CVE-2025-24045Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 17 | CVE-2025-24064Windows Domain Name Service Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 18 | CVE-2025-21180Windows exFAT File System Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 19 | CVE-2025-24044Windows Win32 Kernel Subsystem Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 20 | CVE-2025-24046Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 21 | CVE-2025-24048Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 22 | CVE-2025-24050Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 23 | CVE-2025-24057Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 24 | CVE-2025-24059Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 25 | CVE-2025-24061Windows Mark of the Web Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.01 |
| 26 | CVE-2025-24066Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 27 | CVE-2025-24067Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 28 | CVE-2025-24072Microsoft Local Security Authority (LSA) Server Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 29 | CVE-2025-24075Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 30 | CVE-2025-24077Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 31 | CVE-2025-24079Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2025-24080Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2025-24081Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2025-24082Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2025-24083Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 36 | CVE-2025-24995Kernel Streaming WOW Thunk Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 37 | CVE-2025-26629Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 38 | CVE-2025-26630Microsoft Access Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 39 | CVE-2025-24043WinDbg Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 40 | CVE-2025-26634Windows Core Messaging Elevation of Privileges | None | Not on CISA's list | 7.5 High | 0.01 |
| 41 | CVE-2025-24994Microsoft Windows Cross Device Service Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 42 | CVE-2025-26631Visual Studio Code Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 43 | CVE-2025-25008Windows Server Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 44 | CVE-2025-24070ASP.NET Core and Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 45 | CVE-2025-24078Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.0 High | 0.01 |
| 46 | CVE-2025-26627Azure Arc Installer Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 47 | CVE-2025-24987Windows USB Video Class System Driver Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 48 | CVE-2025-24988Windows USB Video Class System Driver Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 49 | CVE-2025-24986Azure Promptflow Remote Code Execution | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 50 | CVE-2025-24996NTLM Hash Disclosure Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 51 | CVE-2025-24992Windows NTFS Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 52 | CVE-2025-24997DirectX Graphics Kernel File Denial of Service | None | Not on CISA's list | 4.4 Medium | 0.01 |
| 53 | CVE-2025-24055Windows USB Video Class System Driver Information Disclosure | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 54 | CVE-2025-24049Azure Command Line Integration (CLI) Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.00 |
| 55 | CVE-2025-24998Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.00 |
| 56 | CVE-2025-25003Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.00 |
| 57 | CVE-2025-21199Azure Agent Installer for Backup and Site Recovery Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 11 March 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.