March 2025 Patch Tuesday: Microsoft Fixes 57 Vulnerabilities, Including 7 Zero-Days

March 2025’s Patch Tuesday has arrived, and it’s a significant one. On Tuesday, March 11, Microsoft released security updates addressing 57 vulnerabilities, including seven zero-day flaws—six of which are already being actively exploited in the wild. If you’re a Windows admin or security-conscious user, now’s the time to update your systems.

Let’s break down the key points and what you should watch out for.

🔢 Patch Summary at a Glance

Here’s the breakdown of the 57 vulnerabilities fixed this month:

• 🛡️ 23 Elevation of Privilege vulnerabilities
• 🔐 23 Remote Code Execution (RCE) vulnerabilities
• 🚫 3 Security Feature Bypass flaws
• 🔍 4 Information Disclosure bugs
• ❌ 1 Denial of Service (DoS) vulnerability
• 🎭 3 Spoofing vulnerabilities

Additionally, six vulnerabilities are classified as “Critical”, all of which are Remote Code Execution issues. These include flaws in:

• Microsoft Office – CVE-2025-24057
• Remote Desktop Client – CVE-2025-26645
• DNS Server Role (Windows Server) – CVE-2025-24064
• Remote Desktop Services (RDS) – CVE-2025-24035 & CVE-2025-24045
• Windows Subsystem for Linux (WSL) – CVE-2025-24084

⚠️ Spotlight on the 7 Zero-Day Vulnerabilities

Of the seven zero-day flaws, six are already being exploited by threat actors in active campaigns. These flaws affect various Windows components, including the NTFS file system, Win32 kernel subsystem, and Microsoft Management Console.

CVE-2025-24983 – Win32 Kernel Subsystem (Elevation of Privilege)

This is one of the most critical zero-days this month, enabling local attackers to escalate privileges to SYSTEM by exploiting a race condition in the Win32 kernel. Discovered by Filip Jurčacko from ESET, it doesn’t affect Windows 11 or versions newer than Windows Server 2016.

CVE-2025-24984 – Windows NTFS (Information Disclosure)

This vulnerability can be triggered through a malicious USB drive, potentially leaking portions of heap memory. It affects all modern versions of Windows 10, 11, and Server.

CVE-2025-24985 – Windows Fast FAT (Remote Code Execution)

Though technically labeled RCE, this flaw requires local access, such as tricking a user into mounting a malicious VHD file. The attack targets the Fast FAT driver and is particularly dangerous in environments where users frequently interact with removable storage or virtual drives.

CVE-2025-24991 & CVE-2025-24993 – More NTFS Zero-Days

Two additional NTFS-related zero-days also made the list. One enables information disclosure (similar to CVE-2025-24984), and the other leads to remote code execution via heap-based buffer overflow, again triggered via malicious VHD files. These bugs reinforce the importance of handling VHDs with caution.

CVE-2025-26633 – Microsoft Management Console

Discovered by Aliakbar Zahravi at Trend Micro, this flaw in MMC (.msc files) allows attackers to craft malicious files and deliver them via email or messaging platforms. Execution requires user interaction, but the impact can be significant.

CVE-2025-26630 – Microsoft Access

Although not actively exploited, this publicly disclosed vulnerability in Microsoft Access can allow arbitrary code execution if a user opens a malicious file. It impacts versions of Access in Office 2016 through Office 2024, and Microsoft 365 Apps for Enterprise.

🧠 What This Means for You

With six actively exploited vulnerabilities and several affecting core Windows components like NTFS and the kernel, this is not a Patch Tuesday to postpone. These zero-days demonstrate the continued focus of attackers on privilege escalation and local access exploitation, often through cleverly crafted files or physical access vectors like USB drives.

Admins and users should prioritize the following actions:

1. Patch immediately, especially systems running Windows 10, 11, and Windows Server.
2. Audit usage of VHD files and removable media to minimize potential attack surfaces.
3. Educate users on avoiding suspicious attachments or unexpected USB devices.
4. Monitor for abnormal system behavior that could hint at privilege escalation or memory exploitation.

📥 Final Thoughts

Microsoft’s March 2025 Patch Tuesday is a stark reminder of how fast the threat landscape evolves—and how critical timely patching remains. With vulnerabilities actively exploited in the wild, the window for defense is small.

Stay updated, stay secure.

—

https://support.microsoft.com/en-us/topic/march-11-2025-kb5053606-os-builds-19044-5608-and-19045-5608-8beab4af-42c8-4469-9273-d241597431c3

Have something to add or encountered an issue with this month’s patches? Drop a comment below or reach out to us on ToolsLib’s community forums.

🛠️ Stay tuned for our next Patch Tuesday breakdown in April 2025.