У нас новый пакет обновлений безопасности от Microsoft. В этот раз корпорация устранила 72 уязвимости, включая пять, которые уже использовались злоумышленниками, и две 0-day, ставшие достоянием общественности до выхода патча.
Из 72 закрытых багов:
- 28 — RCE (удалённое выполнение кода),
- 17 — повышение привилегий,
- 15 — утечки информации,
- Остальные — отказ в обслуживании, обход защитной функциональности и спуфинг.
Из них шесть критических, причём пять связаны с RCE, а одна — с утечкой данных. Важно: набор не включает баги в Azure, Edge и других продуктах, которые Microsoft уже патчила ранее в этом месяце.
Что там с активно эксплуатируемыми уязвимостями?
Вот список пяти 0-day, которые Microsoft официально признала эксплуатируемыми:
- CVE-2025-30400 — баг в DWM Core Library (повышение привилегий до SYSTEM). Используется «use-after-free» — классическая ошибка управления памятью.
- CVE-2025-32701 и CVE-2025-32706 — уязвимости в Common Log File System Driver. Позволяют получить SYSTEM-доступ через ошибки валидации ввода и всё тот же use-after-free.
- CVE-2025-32709 — драйвер WinSock. Аналогичная проблема с памятью.
- CVE-2025-30397 — RCE в Microsoft Scripting Engine (IE и Edge), эксплуатируется через специально подготовленную ссылку. Пользователя нужно обманом заставить по ней кликнуть.
Microsoft пока не делится деталями кибератак, но факт эксплуатации подтверждён.
И ещё пара 0-day без атак
Две уязвимости были раскрыты публично до выхода патча, но пока атак не зафиксировано:
- CVE-2025-26685 — spoofing в Microsoft Defender for Identity. Доступен неаутентифицированному атакующему в локальной сети.
- CVE-2025-32702 — RCE в Visual Studio через командную инъекцию. Детали — под NDA.
Полный список пропатченных дыр приводим ниже:
| Затронутый компонент | CVE-идентификатор | CVE-наименование | Степень риска |
| .NET, Visual Studio, and Build Tools for Visual Studio | CVE-2025-26646 | .NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability | Важная |
| Active Directory Certificate Services (AD CS) | CVE-2025-29968 | Active Directory Certificate Services (AD CS) Denial of Service Vulnerability | Важная |
| Azure | CVE-2025-33072 | Microsoft msagsfeedback.azurewebsites.net Information Disclosure Vulnerability | Критическая |
| Azure | CVE-2025-30387 | Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability | Важная |
| Azure Automation | CVE-2025-29827 | Azure Automation Elevation of Privilege Vulnerability | Критическая |
| Azure DevOps | CVE-2025-29813 | Azure DevOps Server Elevation of Privilege Vulnerability | Критическая |
| Azure File Sync | CVE-2025-29973 | Microsoft Azure File Sync Elevation of Privilege Vulnerability | Важная |
| Azure Storage Resource Provider | CVE-2025-29972 | Azure Storage Resource Provider Spoofing Vulnerability | Критическая |
| Microsoft Brokering File System | CVE-2025-29970 | Microsoft Brokering File System Elevation of Privilege Vulnerability | Важная |
| Microsoft Dataverse | CVE-2025-47732 | Microsoft Dataverse Remote Code Execution Vulnerability | Критическая |
| Microsoft Dataverse | CVE-2025-29826 | Microsoft Dataverse Elevation of Privilege Vulnerability | Важная |
| Microsoft Defender for Endpoint | CVE-2025-26684 | Microsoft Defender Elevation of Privilege Vulnerability | Важная |
| Microsoft Defender for Identity | CVE-2025-26685 | Microsoft Defender for Identity Spoofing Vulnerability | Важная |
| Microsoft Edge (Chromium-based) | CVE-2025-4050 | Chromium: CVE-2025-4050 Out of bounds memory access in DevTools | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-4096 | Chromium: CVE-2025-4096 Heap buffer overflow in HTML | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-29825 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | Критическая |
| Microsoft Edge (Chromium-based) | CVE-2025-4052 | Chromium: CVE-2025-4052 Inappropriate implementation in DevTools | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-4051 | Chromium: CVE-2025-4051 Insufficient data validation in DevTools | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-4372 | Chromium: CVE-2025-4372 Use after free in WebAudio | Unknown |
| Microsoft Office | CVE-2025-30377 | Microsoft Office Remote Code Execution Vulnerability | Критическая |
| Microsoft Office | CVE-2025-30386 | Microsoft Office Remote Code Execution Vulnerability | Критическая |
| Microsoft Office Excel | CVE-2025-29977 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2025-30383 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2025-29979 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2025-30376 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2025-30393 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2025-32704 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2025-30375 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2025-30379 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Excel | CVE-2025-30381 | Microsoft Excel Remote Code Execution Vulnerability | Важная |
| Microsoft Office Outlook | CVE-2025-32705 | Microsoft Outlook Remote Code Execution Vulnerability | Важная |
| Microsoft Office PowerPoint | CVE-2025-29978 | Microsoft PowerPoint Remote Code Execution Vulnerability | Важная |
| Microsoft Office SharePoint | CVE-2025-30378 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Важная |
| Microsoft Office SharePoint | CVE-2025-30382 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Важная |
| Microsoft Office SharePoint | CVE-2025-30384 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Важная |
| Microsoft Office SharePoint | CVE-2025-29976 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Важная |
| Microsoft PC Manager | CVE-2025-29975 | Microsoft PC Manager Elevation of Privilege Vulnerability | Важная |
| Microsoft Power Apps | CVE-2025-47733 | Microsoft Power Apps Information Disclosure Vulnerability | Критическая |
| Microsoft Scripting Engine | CVE-2025-30397 | Scripting Engine Memory Corruption Vulnerability | Важная |
| Remote Desktop Gateway Service | CVE-2025-26677 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability | Важная |
| Remote Desktop Gateway Service | CVE-2025-29967 | Remote Desktop Client Remote Code Execution Vulnerability | Критическая |
| Remote Desktop Gateway Service | CVE-2025-29831 | Windows Remote Desktop Services Remote Code Execution Vulnerability | Важная |
| Remote Desktop Gateway Service | CVE-2025-30394 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability | Важная |
| Role: Windows Hyper-V | CVE-2025-29955 | Windows Hyper-V Denial of Service Vulnerability | Важная |
| Universal Print Management Service | CVE-2025-29841 | Universal Print Management Service Elevation of Privilege Vulnerability | Важная |
| UrlMon | CVE-2025-29842 | UrlMon Security Feature Bypass Vulnerability | Важная |
| Visual Studio | CVE-2025-32703 | Visual Studio Information Disclosure Vulnerability | Важная |
| Visual Studio | CVE-2025-32702 | Visual Studio Remote Code Execution Vulnerability | Важная |
| Visual Studio Code | CVE-2025-21264 | Visual Studio Code Security Feature Bypass Vulnerability | Важная |
| Web Threat Defense (WTD.sys) | CVE-2025-29971 | Web Threat Defense (WTD.sys) Denial of Service Vulnerability | Важная |
| Windows Ancillary Function Driver for WinSock | CVE-2025-32709 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Важная |
| Windows Common Log File System Driver | CVE-2025-32701 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Важная |
| Windows Common Log File System Driver | CVE-2025-30385 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Важная |
| Windows Common Log File System Driver | CVE-2025-32706 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Важная |
| Windows Deployment Services | CVE-2025-29957 | Windows Deployment Services Denial of Service Vulnerability | Важная |
| Windows Drivers | CVE-2025-29838 | Windows ExecutionContext Driver Elevation of Privilege Vulnerability | Важная |
| Windows DWM | CVE-2025-30400 | Microsoft DWM Core Library Elevation of Privilege Vulnerability | Важная |
| Windows File Server | CVE-2025-29839 | Windows Multiple UNC Provider Driver Information Disclosure Vulnerability | Важная |
| Windows Fundamentals | CVE-2025-29969 | MS-EVEN RPC Remote Code Execution Vulnerability | Важная |
| Windows Hardware Lab Kit | CVE-2025-27488 | Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability | Важная |
| Windows Installer | CVE-2025-29837 | Windows Installer Information Disclosure Vulnerability | Важная |
| Windows Kernel | CVE-2025-24063 | Kernel Streaming Service Driver Elevation of Privilege Vulnerability | Важная |
| Windows Kernel | CVE-2025-29974 | Windows Kernel Information Disclosure Vulnerability | Важная |
| Windows LDAP - Lightweight Directory Access Protocol | CVE-2025-29954 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | Важная |
| Windows Media | CVE-2025-29962 | Windows Media Remote Code Execution Vulnerability | Важная |
| Windows Media | CVE-2025-29963 | Windows Media Remote Code Execution Vulnerability | Важная |
| Windows Media | CVE-2025-29964 | Windows Media Remote Code Execution Vulnerability | Важная |
| Windows Media | CVE-2025-29840 | Windows Media Remote Code Execution Vulnerability | Важная |
| Windows NTFS | CVE-2025-32707 | NTFS Elevation of Privilege Vulnerability | Важная |
| Windows Remote Desktop | CVE-2025-29966 | Remote Desktop Client Remote Code Execution Vulnerability | Критическая |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29836 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29959 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29835 | Windows Remote Access Connection Manager Information Disclosure Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29960 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29832 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29830 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29961 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Важная |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-29958 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Важная |
| Windows Secure Kernel Mode | CVE-2025-27468 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | Важная |
| Windows SMB | CVE-2025-29956 | Windows SMB Information Disclosure Vulnerability | Важная |
| Windows Trusted Runtime Interface Driver | CVE-2025-29829 | Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability | Важная |
| Windows Virtual Machine Bus | CVE-2025-29833 | Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability | Критическая |
| Windows Win32K - GRFX | CVE-2025-30388 | Windows Graphics Component Remote Code Execution Vulnerability | Важная |
