Microsoft's security release of 12 August 2025
Patch Tuesday, August 2025
As of , CISA lists none of the 106 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first by our order: CVE-2025-50165, Windows Graphics Component Remote Code Execution.
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 106 CVEs |
| On CISA's list of exploited vulnerabilities | none |
| CISA's SSVC exploitation: active | none |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 105 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 3 CVEs |
| EPSS 0.10 or more | 7 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-50165Windows Graphics Component Remote Code Execution | Proof of concept | Not on CISA's list | 9.8 Critical | 0.10 |
| 2 | CVE-2025-53778Windows NTLM Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.48 |
| 3 | CVE-2025-50154Microsoft Windows File Explorer Spoofing | None | Not on CISA's list | 6.5 Medium | 0.30 |
| 4 | CVE-2025-53772Web Deploy Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.26 |
| 5 | CVE-2025-53722Windows Remote Desktop Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.22 |
| 6 | CVE-2025-49712Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.19 |
| 7 | CVE-2025-53760Microsoft SharePoint Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.16 |
| 8 | CVE-2025-53766GDI+ Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.08 |
| 9 | CVE-2025-53143Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.08 |
| 10 | CVE-2025-53144Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.08 |
| 11 | CVE-2025-53145Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.08 |
| 12 | CVE-2025-50177Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.04 |
| 13 | CVE-2025-53773GitHub Copilot and Visual Studio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.03 |
| 14 | CVE-2025-53779Windows Kerberos Elevation of Privilege | None | Not on CISA's list | 7.2 High | 0.03 |
| 15 | CVE-2025-24999Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 16 | CVE-2025-47954Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 17 | CVE-2025-50171Remote Desktop Spoofing | None | Not on CISA's list | 9.1 Critical | 0.01 |
| 18 | CVE-2025-49757Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2025-49758Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 20 | CVE-2025-49759Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 21 | CVE-2025-50163Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 22 | CVE-2025-53131Windows Media Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 23 | CVE-2025-53727Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 24 | CVE-2025-53731Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 25 | CVE-2025-53733Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 26 | CVE-2025-53740Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 27 | CVE-2025-53784Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 28 | CVE-2025-50160Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 29 | CVE-2025-50162Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 30 | CVE-2025-50164Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 31 | CVE-2025-53720Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 32 | CVE-2025-50168Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2025-50176DirectX Graphics Kernel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2025-53149Kernel Streaming WOW Thunk Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2025-53735Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 36 | CVE-2025-53737Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 37 | CVE-2025-53738Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 38 | CVE-2025-53739Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 39 | CVE-2025-53741Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 40 | CVE-2025-53759Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 41 | CVE-2025-53761Microsoft PowerPoint Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 42 | CVE-2025-53781Azure Virtual Machines Information Disclosure | None | Not on CISA's list | 7.7 High | 0.01 |
| 43 | CVE-2025-33051Microsoft Exchange Server Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 44 | CVE-2025-50169Windows SMB Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 45 | CVE-2025-53783Microsoft Teams Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 46 | CVE-2025-53793Azure Stack Hub Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 47 | CVE-2025-50159Remote Access Point-to-Point Protocol (PPP) EAP-TLS Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 48 | CVE-2025-50161Win32k Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 49 | CVE-2025-53736Microsoft Word Information Disclosure | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 50 | CVE-2025-48807Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 51 | CVE-2025-49743Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 52 | CVE-2025-25005Microsoft Exchange Server Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 53 | CVE-2025-50166Windows Distributed Transaction Coordinator (MSDTC) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 54 | CVE-2025-50172DirectX Graphics Kernel Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 55 | CVE-2025-53716Windows Local Security Authority Subsystem Service (LSASS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 56 | CVE-2025-53728Microsoft Dynamics 365 (On-Premises) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 57 | CVE-2025-50156Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 58 | CVE-2025-50157Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 59 | CVE-2025-53138Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 60 | CVE-2025-53148Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 61 | CVE-2025-53153Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 62 | CVE-2025-53719Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 63 | CVE-2025-53136NT OS Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 64 | CVE-2025-53156Windows Storage Port Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 65 | CVE-2025-49745Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 66 | CVE-2025-25006Microsoft Exchange Server Spoofing | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 67 | CVE-2025-25007Microsoft Exchange Server Spoofing | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 68 | CVE-2025-49736Microsoft Edge (Chromium-based) for Android Spoofing | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 69 | CVE-2025-49707Azure Virtual Machines Spoofing | None | Not on CISA's list | 7.9 High | 0.00 |
| 70 | CVE-2025-49761Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 71 | CVE-2025-50153Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 72 | CVE-2025-50155Windows Push Notifications Apps Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 73 | CVE-2025-50170Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 74 | CVE-2025-50173Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 75 | CVE-2025-53132Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 76 | CVE-2025-53133Windows PrintWorkflowUserSvc Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 77 | CVE-2025-53141Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 78 | CVE-2025-53151Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 79 | CVE-2025-53152Desktop Windows Manager Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 80 | CVE-2025-53154Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 81 | CVE-2025-53155Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 82 | CVE-2025-53723Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 83 | CVE-2025-53724Windows Push Notifications Apps Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 84 | CVE-2025-53725Windows Push Notifications Apps Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 85 | CVE-2025-53726Windows Push Notifications Apps Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 86 | CVE-2025-53729Microsoft Azure File Sync Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 87 | CVE-2025-53730Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 88 | CVE-2025-53732Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 89 | CVE-2025-53734Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 90 | CVE-2025-53789Windows StateRepository API Server file Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 91 | CVE-2025-49762Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 92 | CVE-2025-50158Windows NTFS Information Disclosure | None | Not on CISA's list | 7.0 High | 0.00 |
| 93 | CVE-2025-50167Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 94 | CVE-2025-53134Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 95 | CVE-2025-53135DirectX Graphics Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 96 | CVE-2025-53137Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 97 | CVE-2025-53140Windows Kernel Transaction Manager Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 98 | CVE-2025-53142Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 99 | CVE-2025-53147Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 100 | CVE-2025-53718Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 12 August 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.