Roundup of Microsoft Patch Tuesday (April 2025)

Summary

On April 09, 2025, Microsoft released its April 2025 Security Updates, which included patches for a total of 124 CVEs, an increase of 66 compared to the previous month.

In terms of vulnerability severity, there were 11 vulnerabilities marked as "Critical," and 111 vulnerabilities were marked as "Important/High". Regarding the types of vulnerabilities, there were primarily 33 remote code execution vulnerabilities, 49 privilege escalation vulnerabilities, and 16 information disclosure vulnerabilities.

Statistics

Vulnerability Trend

Figure 1 Vulnerabilities Patched by Microsoft in the Last 12 Months

On the whole, Microsoft released 124 patches in April 2025, including 11 critical vulnerability patches.

Based on Microsoft's historical vulnerability disclosures and the specific circumstances of this year, Sangfor FarSight Labs estimates that Microsoft will announce fewer vulnerabilities in the coming May in comparison to April. We expect a figure of approximately 80 vulnerabilities.

Comparison of Vulnerability Trends

The following figure shows the number of patches released by Microsoft in the month of April from 2022 to 2025.

Figure 2 Number of Windows Patches Released by Microsoft in April from 2022 to 2025

The following figure shows the trend and number of vulnerabilities at different severity levels addressed by Microsoft in April from 2022 to 2025.

Figure 3 Number of Vulnerabilities by Severity Level Addressed by Microsoft in April from 2022 to 2025

The following figure shows the number of vulnerabilities by type addressed by Microsoft in April from 2022 to 2025.

Figure 4 Number of Vulnerabilities by Type Addressed by Microsoft in April from 2022 to 2025

Data source: Microsoft security updates

Compared to last year, there has been a decrease in terms of the number of vulnerabilities of this year. The number of vulnerabilities addressed by Microsoft in April 2025 has decreased. A total of 124 vulnerability patches, including 11 critical ones, have been reported this month.

Compared to last year, the number of vulnerabilities at the Critical level addressed by Microsoft has increased, and that of vulnerabilities at the Important/High level has decreased. Specifically, 11 vulnerabilities at the Critical level have been addressed, an increase of about 267%; and 111 vulnerabilities at the Important/High level have been addressed, a decrease of about 25%.

In terms of the vulnerability type, the number of remote code execution (RCE) vulnerabilities has decreased; and the number of denial-of-service (DoS) vulnerabilities and elevation of privilege (EoP) vulnerabilities has increased. However, we should remain highly vigilant because, when combined with social engineering techniques, attackers can exploit RCE vulnerabilities to take over an entire LAN and launch attacks.

Details of Key Vulnerabilities

Analysis

Windows CLFS Driver Elevation of Privilege Vulnerability (CVE-2025-29824)

The Common Log File System (CLFS) is a general-purpose log file system that can be accessed by applications running in kernel mode or user mode to construct high-performance transaction logs.

An elevation of privilege vulnerability exists in it, which attackers can exploit to gain higher privileges on the target system. This vulnerability is known to be exploited in the wild, and after assessment, it is considered critical in threat level. We recommend that users promptly update the Microsoft security patches.

Windows LDAP Remote Code Execution Vulnerability (CVE-2025-26663)

The Lightweight Directory Access Protocol (LDAP) is an open, industry standard protocol for efficiently accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. It stores user and permission data in a tree-like structure, and supports fast queries and single sign-on. LDAP is widely used in enterprises' internal systems, cloud services, and identity authentication management.

A remote code execution vulnerability exists in it, which attackers can exploit to execute arbitrary code on the target system. This vulnerability is known to be exploited in the wild, and after assessment, it is considered critical in threat level. We recommend that users promptly update the Microsoft security patches.

Windows LDAP Client Remote Code Execution Vulnerability (CVE-2025-26670)

The LDAP is an open, industry standard protocol for efficiently accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. It stores user and permission data in a tree-like structure, and supports fast queries and single sign-on. LDAP is widely used in enterprises' internal systems, cloud services, and identity authentication management.

A remote code execution vulnerability exists in it, which attackers can exploit to execute arbitrary code on the target system. This vulnerability is known to be exploited in the wild, and after assessment, it is considered critical in threat level. We recommend that users promptly update the Microsoft security patches.

Affected Versions

Solutions

Official Solution

Microsoft has released patches for affected software. Affected users can install the corresponding security updates based on the system versions:

Download Links:

1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824
2. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26663
3. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26670

References

https://msrc.microsoft.com/update-guide/releaseNote/2025-Apr

Timeline

On April 9, 2025, Microsoft released a security bullet.

On April 9, 2025, Sangfor FarSight Labs released a vulnerability alert.

Learn More

Sangfor FarSight Labs researches the latest cyber threats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyber threats, providing fast and easy protection for customers.