May 2025 Patch Tuesday Analysis

Today’s Patch Tuesday Alert addresses Microsoft’s May 2025 Security Updates. We are actively working on coverage for these vulnerabilities and expect to ship ASPL-1156 as soon as coverage is completed.

In-The-Wild & Disclosed CVEs

CVE-2025-32706

A vulnerability in the Windows Common Log File System (CLFS) Driver could allow a malicious actor to elevate their privileges to SYSTEM. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-32701

A vulnerability in the Windows Common Log File System (CLFS) Driver could allow a malicious actor to elevate their privileges to SYSTEM. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-30400

A vulnerability in the Microsoft DWM Core Library could allow a malicious actor to elevate their privileges to SYSTEM. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-32709

A vulnerability in the Windows Ancillary Function Driver (AFD) for WinSock could allow a malicious actor to elevate their privileges to Administrator. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-30397

A vulnerability in the Scripting Engine could allow a malicious actor to trick a user running Edge in Internet Explorer mode into clicking a malicious link that would execute code. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-32702

A vulnerability in Visual Studio could allow a malicious actor to convince a user to download a malicious file, which will cause code execution on the local system due to command injection. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2025-26685

A vulnerability in Microsoft Defender for Identity Spoofing could be exploited by an attacker with access to the local network. Microsoft has stated that no action is required to remediate this vulnerability but suggests if you have disabled NTLM completely in your environment and would like to keep using this feature, you should open a support case. Microsoft has reported this vulnerability as Exploitation Unlikely.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also color coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted.

Other Information

At the time of publication, there were no new advisories included with the May Security Guidance.