Microsoft’s April Security Update of High-Risk Vulnerabilities in Multiple Products

Overview

On April 9, NSFOCUS CERT detected that Microsoft released a security update patch for April, fixing 126 security problems in widely used products such as Windows, Microsoft Office, Azure, Microsoft Edge for iOS, Microsoft Visual Studio, etc. This includes high-risk vulnerabilities such as privilege escalation and remote code execution.

Among the vulnerabilities fixed in Microsoft’s update this month, 11 are critical in severity, 112 are important in severity, 1 vulnerability has been detected for exploitation in the field:

Windows Common Log File System Driver Privilege Escalation Vulnerability (CVE-2025-29824)

Please update patches for protection as soon as possible. For a complete list of vulnerabilities, check the appendix.

Reference link: https://msrc.microsoft.com/update-guide/en-us/releaseNote/2025-Apr

Key Vulnerabilities

Windows Common Log File System Driver Privilege Escalation Vulnerability (CVE-2025-29824):

A privilege escalation vulnerability exists in the Windows Common Log File System driver. Due to a use-after-free error in the Windows Common Log File System driver, an authenticated local attacker can gain SYSTEM privileges through this vulnerability. The vulnerability has been exploited, with a CVSS score of 7.8.

Official Announcement Link: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824

Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2025-29794):

Microsoft SharePoint has a remote code execution vulnerability. Due to improper authorization in Microsoft Office SharePoint, an authenticated remote attacker can execute arbitrary code through this vulnerability. The CVSS score is 8.8.

Official Announcement Link: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29794

Windows Remote Desktop Service Remote Code Execution Vulnerability (CVE-2025-27480, CVE-2025-27482):

The Windows Remote Desktop Service has a remote code execution vulnerability. Due to improper memory locking and a use-after-free error in the Remote Desktop Gateway Service, an unauthenticated attacker can exploit this flaw by connecting to a system with the Remote Desktop Gateway role, triggering a race condition to create a use-after-free scenario, and then executing arbitrary code on the system. The CVSS score is 8.1.

Official Announcement Link:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27480

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27482

Windows Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability (CVE-2025-26670, CVE-2025-26663):

The Windows Lightweight Directory Access Protocol (LDAP) client has a remote code execution vulnerability. Due to a use-after-free error in the LDAP client, an unauthenticated attacker can send specially crafted requests to the vulnerable LDAP server in sequence to achieve remote code execution. The CVSS score is 8.1.

Official Announcement Link:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26663

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26670

Microsoft Excel Remote Code Execution Vulnerability (CVE-2025-27752):

Microsoft Excel has a remote code execution vulnerability. Due to a heap-based buffer overflow in Microsoft Office Excel, an unauthenticated remote attacker can execute code locally. The CVSS score is 7.8.

Official Announcement Link: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-27752

Windows Kerberos Privilege Escalation Vulnerability (CVE-2025-26647):

Windows Kerberos has a privilege escalation vulnerability. Due to improper input validation in Windows Kerberos, an unauthenticated attacker can compromise a trusted Certificate Authority (CA) and issue certificates with specific Subject Key Identifier (SKI) values to impersonate other accounts, thereby achieving privilege escalation. CVSS score 8.1.

Official Announcement Link: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26647

Windows Routing and Remote Access Services (RRAS) Information Disclosure Vulnerability (CVE-2025-26669):

Windows Routing and Remote Access Services (RRAS) has an information disclosure vulnerability. Due to out-of-bounds reads in the Windows Routing and Remote Access Service (RRAS), an unauthenticated attacker can exploit this vulnerability by tricking users into sending requests to a malicious server, thereby executing arbitrary code on the target system. The CVSS score is 8.8.

Official Announcement Link: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26669

Scope of Impact

The following are the affected product versions that focus on key vulnerabilities. For the scope of other products affected by vulnerabilities, please refer to the official announcement link.

Mitigation

Patch update

Microsoft has released security patches to address the aforementioned vulnerabilities for supported product versions. We strongly recommend that affected users install these patches as soon as possible to protect their systems. The official download link is:

https://msrc.microsoft.com/update-guide/releaseNote/2025-Apr

Note: Due to network issues, computer environment problems, or other reasons, patch updates via Windows Update may fail. After installing the patches, users should promptly check whether the updates have been successfully applied.

To do this, right-click the Windows icon, select “Settings (N),” then choose “Update & Security” – “Windows Update.” Check the prompts on this page or click “View update history” to review the update status.

For updates that failed to install, click on the update name to be redirected to the official Microsoft download page. We suggest users click the link on that page to go to the “Microsoft Update Catalog” website to download the standalone package and install it manually.

Appendix: Vulnerability List

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, a pioneering leader in cybersecurity, is dedicated to safeguarding telecommunications, Internet service providers, hosting providers, and enterprises from sophisticated cyberattacks.

Founded in 2000, NSFOCUS operates globally with over 4000 employees at two headquarters in Beijing, China, and Santa Clara, CA, USA, and over 50 offices worldwide. It has a proven track record of protecting over 25% of the Fortune Global 500 companies, including four of the five largest banks and six of the world’s top ten telecommunications companies.

Leveraging technical prowess and innovation, NSFOCUS delivers a comprehensive suite of security solutions, including the Intelligent Security Operations Platform (ISOP) for modern SOC, DDoS Protection, Continuous Threat Exposure Management (CTEM) Service and Web Application and API Protection (WAAP). All the solutions and services are augmented by the Security Large Language Model (SecLLM), ML, patented algorithms and other cutting-edge research achievements developed by NSFOCUS.

The post Microsoft’s April Security Update of High-Risk Vulnerabilities in Multiple Products appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

*** This is a Security Bloggers Network syndicated blog from NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. authored by NSFOCUS. Read the original post at: https://nsfocusglobal.com/microsofts-april-security-update-of-high-risk-vulnerabilities-in-multiple-products/