Microsoft's security release of 13 May 2025
Patch Tuesday, May 2025
As of , CISA lists five of the 71 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-30397, Scripting Engine Memory Corruption.
On CISA's list of exploited vulnerabilities
- CVE-2025-30397Scripting Engine Memory Corruption. Listed by CISA on 13 May 2025, release day
- CVE-2025-32706Windows Common Log File System Driver Elevation of Privilege. Listed by CISA on 13 May 2025, release day
- CVE-2025-30400Microsoft DWM Core Library Elevation of Privilege. Listed by CISA on 13 May 2025, release day
- CVE-2025-32709Windows Ancillary Function Driver for WinSock Elevation of Privilege. Listed by CISA on 13 May 2025, release day
- CVE-2025-32701Windows Common Log File System Driver Elevation of Privilege. Listed by CISA on 13 May 2025, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 71 CVEs |
| On CISA's list of exploited vulnerabilities | 5 CVEs |
| CISA's SSVC exploitation: active | 5 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 66 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | 4 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-30397Scripting Engine Memory Corruption | Active | Patch soonListed | 7.5 High | 0.27 |
| 2 | CVE-2025-32706Windows Common Log File System Driver Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.02 |
| 3 | CVE-2025-30400Microsoft DWM Core Library Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.02 |
| 4 | CVE-2025-32709Windows Ancillary Function Driver for WinSock Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.02 |
| 5 | CVE-2025-32701Windows Common Log File System Driver Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.01 |
| 6 | CVE-2025-29971Web Threat Defense (WTD.sys) Denial of Service | None | Not on CISA's list | 7.5 High | 0.67 |
| 7 | CVE-2025-30394Windows Remote Desktop Gateway (RD Gateway) Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.33 |
| 8 | CVE-2025-29962Windows Media Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.15 |
| 9 | CVE-2025-30388Windows Graphics Component Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.04 |
| 10 | CVE-2025-30382Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.03 |
| 11 | CVE-2025-26677Windows Remote Desktop Gateway (RD Gateway) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 12 | CVE-2025-29959Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 13 | CVE-2025-29960Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 14 | CVE-2025-29968Active Directory Certificate Services (AD CS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 15 | CVE-2025-30387Document Intelligence Studio On-Prem Elevation of Privilege | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 16 | CVE-2025-29840Windows Media Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 17 | CVE-2025-29963Windows Media Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 18 | CVE-2025-29964Windows Media Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2025-29966Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 20 | CVE-2025-29967Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 21 | CVE-2025-30377Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 22 | CVE-2025-30386Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 23 | CVE-2025-26646.NET, Visual Studio, and Build Tools for Visual Studio Spoofing | None | Not on CISA's list | 8.0 High | 0.01 |
| 24 | CVE-2025-24063Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 25 | CVE-2025-29970Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 26 | CVE-2025-29975Microsoft PC Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 27 | CVE-2025-29976Microsoft SharePoint Server Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 28 | CVE-2025-29977Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 29 | CVE-2025-29978Microsoft PowerPoint Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 30 | CVE-2025-29979Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 31 | CVE-2025-30375Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2025-30376Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2025-30379Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2025-30381Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2025-30383Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 36 | CVE-2025-30385Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 37 | CVE-2025-32702Visual Studio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 38 | CVE-2025-32705Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 39 | CVE-2025-32707NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 40 | CVE-2025-29831Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 41 | CVE-2025-29969MS-EVEN RPC Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 42 | CVE-2025-30384Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.4 High | 0.01 |
| 43 | CVE-2025-29826Microsoft Dataverse Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 44 | CVE-2025-21264Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 7.1 High | 0.01 |
| 45 | CVE-2025-30378Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.0 High | 0.01 |
| 46 | CVE-2025-26685Microsoft Defender for Identity Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 47 | CVE-2025-29830Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 48 | CVE-2025-29832Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 49 | CVE-2025-29835Windows Remote Access Connection Manager Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 50 | CVE-2025-29836Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 51 | CVE-2025-29958Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 52 | CVE-2025-29961Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 53 | CVE-2025-29955Windows Hyper-V Denial of Service | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 54 | CVE-2025-29957Windows Deployment Services Denial of Service | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 55 | CVE-2025-29954Windows Lightweight Directory Access Protocol (LDAP) Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 56 | CVE-2025-29974Windows Kernel Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 57 | CVE-2025-29829Windows Trusted Runtime Interface Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 58 | CVE-2025-29837Windows Installer Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 59 | CVE-2025-32703Visual Studio Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 60 | CVE-2025-29956Windows SMB Information Disclosure | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 61 | CVE-2025-29839Windows Multiple UNC Provider Driver Information Disclosure | None | Not on CISA's list | 4.0 Medium | 0.01 |
| 62 | CVE-2025-32704Microsoft Excel Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 63 | CVE-2025-30393Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 64 | CVE-2025-29833Microsoft Virtual Machine Bus (VMBus) Remote Code Execution | None | Not on CISA's list | 7.7 High | 0.00 |
| 65 | CVE-2025-29842UrlMon Security Feature Bypass | None | Not on CISA's list | 7.5 High | 0.00 |
| 66 | CVE-2025-29838Windows ExecutionContext Driver Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.00 |
| 67 | CVE-2025-27468Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 68 | CVE-2025-29841Universal Print Management Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 69 | CVE-2025-29973Microsoft Azure File Sync Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 70 | CVE-2025-26684Microsoft Defender Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 71 | CVE-2025-27488Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 13 May 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.