cve.bz

Microsoft Patch Tuesday, June 2025: the CVEs

Filter

Microsoft Patch Tuesday June 2025: the CVEs Microsoft published on 10 June 2025, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: May 2025, Apr 2025, Mar 2025, Feb 2025, Jan 2025, Dec 2024, Nov 2024, Oct 2024, Sep 2024, Aug 2024, Jul 2024, Jun 2024. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 8.2CVE-2025-47977EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Nuance Digital Engagement Platform allows an unauthorized attacker to perform spoofing over a network.

  2. 4.4CVE-2025-47969EPSS 0.7%

    Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally.

  3. 7.8CVE-2025-47968EPSS 0.4%

    Improper input validation in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.

  4. 7.8CVE-2025-47962EPSS 1.6%

    Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally.

  5. 8.4CVE-2025-47957ExploitEPSS 1.4%

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  6. 5.5CVE-2025-47956EPSS 0.8%

    External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

  7. 7.8CVE-2025-47955EPSS 0.9%

    Improper privilege management in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

  8. 8.4CVE-2025-47953EPSS 0.6%

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  9. 7.8CVE-2025-47176EPSS 0.8%

    '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.

  10. 7.8CVE-2025-47175ExploitEPSS 2.5%

    Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  11. 7.8CVE-2025-47174EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  12. 7.8CVE-2025-47173EPSS 0.6%

    Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.

  13. 8.8CVE-2025-47172EPSS 1.8%

    Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  14. 6.7CVE-2025-47171ExploitEPSS 1.8%

    Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.

  15. 7.8CVE-2025-47170EPSS 0.7%

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  16. 7.8CVE-2025-47169EPSS 0.7%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  17. 7.8CVE-2025-47168EPSS 0.7%

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  18. 8.4CVE-2025-47167EPSS 0.7%

    Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

  19. 8.8CVE-2025-47166ExploitEPSS 23%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  20. 7.8CVE-2025-47165ExploitEPSS 2.3%

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  21. 8.4CVE-2025-47164EPSS 0.7%

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  22. 8.8CVE-2025-47163EPSS 22%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  23. 8.4CVE-2025-47162EPSS 0.8%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  24. 5.4CVE-2025-47160EPSS 0.9%

    Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

  25. 7.8CVE-2025-33075EPSS 0.6%

    Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally.

  26. 8.8CVE-2025-33073KEVExploitEPSS 83%

    Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

  27. 8.1CVE-2025-33071EPSS 23%

    Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.

  28. 8.1CVE-2025-33070EPSS 10%

    Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network.

  29. 5.1CVE-2025-33069EPSS 0.3%

    Improper verification of cryptographic signature in App Control for Business (WDAC) allows an unauthorized attacker to bypass a security feature locally.

  30. 7.5CVE-2025-33068EPSS 1.9%

    Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.

  31. 8.4CVE-2025-33067EPSS 0.5%

    Improper privilege management in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

  32. 8.8CVE-2025-33066EPSS 1.1%

    Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

  33. 5.5CVE-2025-33065EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  34. 8.8CVE-2025-33064EPSS 1.4%

    Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.

  35. 5.5CVE-2025-33063EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  36. 5.5CVE-2025-33062EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  37. 5.5CVE-2025-33061EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  38. 5.5CVE-2025-33060EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  39. 5.5CVE-2025-33059EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  40. 5.5CVE-2025-33058EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  41. 6.5CVE-2025-33057EPSS 1.9%

    Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to deny service over a network.

  42. 7.5CVE-2025-33056EPSS 1.8%

    Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.

  43. 5.5CVE-2025-33055EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  44. 8.8CVE-2025-33053KEVExploitEPSS 87%

    External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

  45. 5.5CVE-2025-33052EPSS 0.6%

    Use of uninitialized resource in Windows DWM Core Library allows an authorized attacker to disclose information locally.

  46. 7.5CVE-2025-33050EPSS 1.9%

    Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  47. 7.5CVE-2025-32725EPSS 1.9%

    Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  48. 7.5CVE-2025-32724EPSS 1.9%

    Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

  49. 5.5CVE-2025-32722EPSS 1.2%

    Improper access control in Windows Storage Port Driver allows an authorized attacker to disclose information locally.

  50. 7.3CVE-2025-32721EPSS 0.7%

    Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.

  51. 5.5CVE-2025-32720EPSS 0.7%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  52. 5.5CVE-2025-32719EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  53. 7.8CVE-2025-32718EPSS 0.5%

    Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally.

  54. 7.8CVE-2025-32716EPSS 0.5%

    Out-of-bounds read in Windows Media allows an authorized attacker to elevate privileges locally.

  55. 6.5CVE-2025-32715EPSS 1.6%

    Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

  56. 7.8CVE-2025-32714EPSS 1.4%

    Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.

  57. 7.8CVE-2025-32713EPSS 0.8%

    Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  58. 7.8CVE-2025-32712EPSS 0.5%

    Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

  59. 8.1CVE-2025-32710EPSS 1.1%

    Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

  60. 8.1CVE-2025-29828EPSS 1.3%

    Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a network.

  61. 5.5CVE-2025-24069EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  62. 5.5CVE-2025-24068EPSS 0.6%

    Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

  63. 5.5CVE-2025-24065EPSS 0.6%

    Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.