Microsoft's security release of 8 April 2025
Patch Tuesday, April 2025
As of , CISA lists one of the 119 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-29824, Windows Common Log File System Driver Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2025-29824Windows Common Log File System Driver Elevation of Privilege. Listed by CISA on 8 April 2025, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 119 CVEs |
| On CISA's list of exploited vulnerabilities | 1 CVE |
| CISA's SSVC exploitation: active | 1 CVE |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 118 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | none |
| EPSS 0.10 or more | 4 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-29824Windows Common Log File System Driver Elevation of Privilege | Active | Patch this weekListed | 7.8 High | 0.14 |
| 2 | CVE-2025-29793Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.24 |
| 3 | CVE-2025-27480Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.13 |
| 4 | CVE-2025-26670Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.11 |
| 5 | CVE-2025-21204Windows Process Activation Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.07 |
| 6 | CVE-2025-29794Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.05 |
| 7 | CVE-2025-29809Windows Kerberos Security Feature Bypass | None | Not on CISA's list | 7.1 High | 0.04 |
| 8 | CVE-2025-27738Windows Resilient File System (ReFS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.04 |
| 9 | CVE-2025-27740Active Directory Certificate Services Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.03 |
| 10 | CVE-2025-26673Windows Lightweight Directory Access Protocol (LDAP) Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 11 | CVE-2025-27469Windows Lightweight Directory Access Protocol (LDAP) Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 12 | CVE-2025-29810Active Directory Domain Services Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.03 |
| 13 | CVE-2025-21197Windows NTFS Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.03 |
| 14 | CVE-2025-26651Windows Local Session Manager (LSM) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.03 |
| 15 | CVE-2025-26647Windows Kerberos Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 16 | CVE-2025-27477Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 17 | CVE-2025-26663Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.02 |
| 18 | CVE-2025-27482Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.02 |
| 19 | CVE-2025-27751Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 20 | CVE-2025-21174Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 21 | CVE-2025-26641Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 22 | CVE-2025-26652Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 23 | CVE-2025-26680Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 24 | CVE-2025-26682ASP.NET Core and Visual Studio Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 25 | CVE-2025-27470Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 26 | CVE-2025-27473HTTP.sys Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 27 | CVE-2025-27479Kerberos Key Distribution Proxy Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 28 | CVE-2025-27485Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 29 | CVE-2025-27486Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 30 | CVE-2025-29805Outlook for Android Information Disclosure | None | Not on CISA's list | 7.5 High | 0.02 |
| 31 | CVE-2025-21203Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 32 | CVE-2025-26664Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 33 | CVE-2025-26667Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 34 | CVE-2025-26672Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 35 | CVE-2025-26676Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 36 | CVE-2025-27474Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 37 | CVE-2025-27472Windows Mark of the Web Security Feature Bypass | None | Not on CISA's list | 5.4 Medium | 0.02 |
| 38 | CVE-2025-21205Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 39 | CVE-2025-21221Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 40 | CVE-2025-21222Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 41 | CVE-2025-26669Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 8.8 High | 0.01 |
| 42 | CVE-2025-27481Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 43 | CVE-2025-27737Windows Security Zone Mapping Security Feature Bypass | None | Not on CISA's list | 8.6 High | 0.01 |
| 44 | CVE-2025-26678Windows Defender Application Control Security Feature Bypass | None | Not on CISA's list | 8.4 High | 0.01 |
| 45 | CVE-2025-26671Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 46 | CVE-2025-27487Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 47 | CVE-2025-24058Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 48 | CVE-2025-24060Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 49 | CVE-2025-24062Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 50 | CVE-2025-24073Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 51 | CVE-2025-24074Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 52 | CVE-2025-26639Windows USB Print Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 53 | CVE-2025-26642Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 54 | CVE-2025-26666Windows Media Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 55 | CVE-2025-26674Windows Media Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 56 | CVE-2025-26675Windows Subsystem for Linux Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 57 | CVE-2025-26679RPC Endpoint Mapper Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 58 | CVE-2025-26688Microsoft Virtual Hard Disk Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 59 | CVE-2025-27467Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 60 | CVE-2025-27476Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 61 | CVE-2025-27483NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 62 | CVE-2025-27489Azure Local Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 63 | CVE-2025-27490Windows Bluetooth Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 64 | CVE-2025-27727Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 65 | CVE-2025-27728Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 66 | CVE-2025-27729Windows Shell Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 67 | CVE-2025-27730Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 68 | CVE-2025-27731Microsoft OpenSSH for Windows Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 69 | CVE-2025-27733NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 70 | CVE-2025-27739Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 71 | CVE-2025-27741NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 72 | CVE-2025-27743Microsoft System Center Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 73 | CVE-2025-27744Microsoft Office Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 74 | CVE-2025-27745Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 75 | CVE-2025-27746Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 76 | CVE-2025-27747Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 77 | CVE-2025-27748Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 78 | CVE-2025-27749Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 79 | CVE-2025-27750Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 80 | CVE-2025-27752Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 81 | CVE-2025-29791Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 82 | CVE-2025-29800Microsoft AutoUpdate (MAU) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 83 | CVE-2025-29801Microsoft AutoUpdate (MAU) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 84 | CVE-2025-29811Windows Mobile Broadband Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 85 | CVE-2025-29812DirectX Graphics Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 86 | CVE-2025-29820Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 87 | CVE-2025-29822Microsoft OneNote Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.01 |
| 88 | CVE-2025-29823Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 89 | CVE-2025-26668Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 90 | CVE-2025-26686Windows TCP/IP Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 91 | CVE-2025-26687Win32k Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 92 | CVE-2025-27484Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 93 | CVE-2025-26628Azure Local Cluster Information Disclosure | None | Not on CISA's list | 7.3 High | 0.01 |
| 94 | CVE-2025-29792Microsoft Office Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 95 | CVE-2025-29802Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 96 | CVE-2025-29804Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 97 | CVE-2025-27491Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.01 |
| 98 | CVE-2025-25002Azure Local Cluster Information Disclosure | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 99 | CVE-2025-26637Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 100 | CVE-2025-26681Win32k Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 8 April 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.