Microsoft Patches 130 Vulnerabilities, Together with Vital Flaws in SPNEGO and SQL Server

Thank you for reading this post, don't forget to subscribe!

For the primary time in 2025, Microsoft’s Patch Tuesday updates didn’t bundle fixes for exploited safety vulnerabilities, however acknowledged one of many addressed flaws had been publicly identified.

The patches resolve a whopping 130 vulnerabilities, together with 10 different non-Microsoft CVEs that have an effect on Visible Studio, AMD, and its Chromium-based Edge browser. Of those 10 are rated Vital and the remaining are all rated Vital in severity.

“The 11-month streak of patching a minimum of one zero-day that was exploited within the wild ended this month,” Satnam Narang, Senior Employees Analysis Engineer at Tenable, mentioned.

Fifty-three of those shortcomings are labeled as privilege escalation bugs adopted by 42 as distant code execution, 17 as data disclosure, and eight as safety characteristic bypasses. These patches are along with two different flaws addressed by the corporate within the Edge browser for the reason that launch of final month’s Patch Tuesday replace.

The vulnerability that is listed as publicly identified is an data disclosure flaw in Microsoft SQL Server (CVE-2025-49719, CVSS rating: 7.5) that would allow an unauthorized attacker to leak uninitialized reminiscence.

“An attacker would possibly effectively study nothing of any worth, however with luck, persistence, or some very artful massaging of the exploit, the prize might be cryptographic key materials or different crown jewels from the SQL Server,” Adam Barnett, Lead Software program Engineer at Rapid7, mentioned in an announcement.

Mike Walters, President and Co-Founding father of Action1, mentioned the flaw probably is the results of improper enter validation in SQL Server’s reminiscence administration, permitting entry to uninitialized reminiscence.

“In consequence, attackers might retrieve remnants of delicate information, corresponding to credentials or connection strings,” Walters added. “It impacts each the SQL Server engine and functions utilizing OLE DB drivers.”

Probably the most important flaw patched by Microsoft as a part of this month’s updates issues a case of distant code execution impacting SPNEGO Prolonged Negotiation (NEGOEX). Tracked as CVE-2025-47981, it carries a CVSS rating of 9.8 out of 10.0.

“Heap-based buffer overflow in Home windows SPNEGO Prolonged Negotiation permits an unauthorized attacker to execute code over a community,” Microsoft mentioned in an advisory. “An attacker might exploit this vulnerability by sending a malicious message to the server, doubtlessly resulting in distant code execution.”

An nameless researcher and Yuki Chen have been credited with discovering and repairing the flaw. Microsoft famous that the problem solely impacts Home windows shopper machines operating Home windows 10, model 1607 and above as a result of “Community safety: Permit PKU2U authentication requests to this pc to make use of on-line identities” Group Coverage Object (GPO) being enabled by default.

“As all the time, Distant Code Execution is dangerous, however early evaluation is suggesting that this vulnerability could also be ‘wormable’ – the form of vulnerability that might be leveraged in self-propagating malware and make many revisit trauma from the WannaCry incident,” watchTowr founder and CEO Benjamin Harris mentioned.

“Microsoft is obvious on pre-requisites right here: no authentication required, simply community entry, and Microsoft themselves imagine exploitation is ‘Extra Seemingly.’ We should not idiot ourselves – if the personal trade has observed this vulnerability, it’s actually already on the radar of each attacker with an oz of malice. Defenders have to drop every thing, patch quickly, and search out uncovered programs.”

Different vulnerabilities of significance embrace distant code execution flaws impacting Home windows KDC Proxy Service (CVE-2025-49735, CVSS rating: 8.1), Home windows Hyper-V (CVE-2025-48822, CVSS rating: 8.6), and Microsoft Workplace (CVE-2025-49695, CVE-2025-496966, and CVE-2025-49697, CVSS scores: 8.4).

“What makes CVE-2025-49735 important is the community publicity mixed with no required privileges or person interplay. Regardless of its excessive assault complexity, the vulnerability opens the door to pre-auth distant compromise, significantly enticing to APTs and nation-state actors,” Ben McCarthy, Lead Cyber Safety Engineer at Immersive, mentioned.

“The attacker should win a race situation – a timing flaw the place reminiscence is freed and reallocated in a particular window – which means reliability is low for now. Nonetheless, such points might be weaponized with methods like heap grooming, making eventual exploitation possible.”

Elsewhere, the replace closes out 5 safety characteristic bypasses in Bitlocker (CVE-2025-48001, CVE-2025-48003, CVE-2025-48800, CVE-2025-48804, and CVE-2025-48818, CVSS scores: 6.8) that would permit an attacker with bodily entry the gadget to pay money for encrypted information.

“An attacker might exploit this vulnerability by loading a WinRE.wim file whereas the OS quantity is unlocked, granting entry to BitLocker encrypted information,” Microsoft mentioned about CVE-2025-48804.

Researchers Netanel Ben Simon and Alon Leviev with Microsoft Offensive Analysis and Safety Engineering (MORSE) have been acknowledged for reporting the 5 points within the built-in disk encryption software.

“If exploited, these flaws might expose delicate information, credentials, or permit tampering with system integrity,” Jacob Ashdown, Cyber Safety Engineer at Immersive, mentioned. “This poses a selected danger, particularly for organizations the place gadgets could also be misplaced or stolen, as attackers with hands-on entry might doubtlessly bypass encryption and extract delicate information.”

It is also price noting that July 8, 2025, formally marks the tip of the street for SQL Server 2012, which can not obtain any future safety patches within the record of the Prolonged Safety Replace (ESU) program coming to a detailed.

Software program Patches from Different Distributors

Along with Microsoft, safety updates have additionally been launched by different distributors over the previous couple of weeks to rectify a number of vulnerabilities, together with —