cve.bz

Microsoft Patch Tuesday, April 2025: the CVEs, page 2

Filter

Microsoft Patch Tuesday April 2025: the CVEs Microsoft published on 8 April 2025, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Mar 2025, Feb 2025, Jan 2025, Dec 2024, Nov 2024, Oct 2024, Sep 2024, Aug 2024, Jul 2024, Jun 2024, May 2024, Apr 2024. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 7.0CVE-2025-26640EPSS 0.5%

    Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.

  2. 7.8CVE-2025-26639EPSS 0.6%

    Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

  3. 6.8CVE-2025-26637EPSS 0.9%

    Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

  4. 6.5CVE-2025-26635EPSS 1.5%

    Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.

  5. 5.5CVE-2025-26628EPSS 1.4%

    Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally.

  6. 5.7CVE-2025-25002EPSS 1.1%

    Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network.

  7. 7.8CVE-2025-24074EPSS 0.6%

    Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  8. 7.8CVE-2025-24073EPSS 0.6%

    Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  9. 7.8CVE-2025-24062EPSS 0.6%

    Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2025-24060EPSS 0.6%

    Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  11. 7.8CVE-2025-24058EPSS 0.6%

    Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  12. 8.8CVE-2025-21222EPSS 1.4%

    Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

  13. 8.8CVE-2025-21221EPSS 1.4%

    Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

  14. 8.8CVE-2025-21205EPSS 1.4%

    Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.

  15. 7.8CVE-2025-21204EPSS 7.1%

    Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

  16. 6.5CVE-2025-21203EPSS 1.7%

    Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

  17. 6.5CVE-2025-21197EPSS 3.3%

    Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.

  18. 7.0CVE-2025-21191EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.

  19. 7.5CVE-2025-21174EPSS 2.2%

    Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.