Summary
Microsoft heeft kwetsbaarheden verholpen in Windows.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Omzeilen van beveiligingsmaatregel
- Uitvoer van willekeurige code (root/adminrechten)
- Uitvoer van willekeurige code (Gebruikersrechten)
- Verkrijgen van verhoogde rechten
- Toegang tot gevoelige gegevens
- Voordoen als andere gebruiker
Van de kwetsbaarheden met kenmerk CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993 en CVE-2025-26633 geeft Microsoft aan informatie te hebben dat deze eerder actief zijn misbruikt als Zeroday. Er is geen publieke Proof-of-Concept (PoC) of exploitcode bekend. De kwetsbaarheden zijn uitsluitend lokaal te misbruiken. Grootschalig actief misbruik wordt hierdoor niet waarschijnlijk geacht.
```
Windows Kernel-Mode Drivers:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24066 | 8.40 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Remote Desktop Client:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-26645 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Kernel Streaming WOW Thunk Service Driver:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24995 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Windows USB Video Driver:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24987 | 6.60 | Verkrijgen van verhoogde rechten |
| CVE-2025-24988 | 6.60 | Verkrijgen van verhoogde rechten |
| CVE-2025-24055 | 4.30 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|
Windows Routing and Remote Access Service (RRAS):
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24051 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Role: DNS Server:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24064 | 8.10 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Management Console:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-26633 | 7.00 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
Windows exFAT File System:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-21180 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Windows Cross Device Service:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24076 | 7.30 | Verkrijgen van verhoogde rechten |
| CVE-2025-24994 | 7.30 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Windows Fast FAT Driver:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24985 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Microsoft Windows:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2024-9157 | onb. | Verkrijgen van verhoogde rechten |
| CVE-2025-25008 | 7.10 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Windows Mark of the Web (MOTW):
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24061 | 7.80 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
Windows Win32 Kernel Subsystem:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24044 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2025-24983 | 7.00 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Windows Kernel Memory:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24997 | 4.40 | Denial-of-Service |
|----------------|------|-------------------------------------|
Microsoft Local Security Authority Server (lsasrv):
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24072 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Microsoft Streaming Service:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24046 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2025-24067 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Windows Telephony Server:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24056 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Windows NTLM:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24996 | 6.50 | Voordoen als andere gebruiker |
| CVE-2025-24054 | 6.50 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|
Windows MapUrlToZone:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-21247 | 4.30 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
Windows Common Log File System Driver:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24059 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Windows Hyper-V:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24048 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2025-24050 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Windows Remote Desktop Services:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24035 | 8.10 | Uitvoeren van willekeurige code |
| CVE-2025-24045 | 8.10 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Windows Subsystem for Linux:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24084 | 8.40 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Windows File Explorer:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24071 | 7.50 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|
Windows NTFS:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24984 | 4.60 | Toegang tot gevoelige gegevens |
| CVE-2025-24991 | 5.50 | Toegang tot gevoelige gegevens |
| CVE-2025-24992 | 5.50 | Toegang tot gevoelige gegevens |
| CVE-2025-24993 | 7.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 37
-
High 7.8
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
KEV Mar 11, 2025 -
High 7.8CVE-2025-24993 Exploited
Windows NTFS Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
KEV Mar 11, 2025 -
High 7.0CVE-2025-24983 Exploited
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
KEV Mar 11, 2025 -
High 7.0
Microsoft Management Console Security Feature Bypass Vulnerability
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
KEV Mar 11, 2025 -
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
KEV Apr 17, 2025 -
Medium 5.5CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
KEV Mar 11, 2025 -
Medium 4.6CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
KEV Mar 11, 2025 -
High 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows Telephony Service Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Telephony Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
-
High 8.4
Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability
Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally.
-
High 8.1CVE-2025-24035 Public exploit
Windows Remote Desktop Services Remote Code Execution Vulnerability
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
-
High 8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
-
High 8.1
Windows Domain Name Service Remote Code Execution Vulnerability
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 7.8
Privilege Escalation Vulnerability in CxUIUSvc service
** UNSUPPORTED WHEN ASSIGNED ** A privilege escalation vulnerability in CxUIUSvc64.exe and CxUIUSvc32.exe of Synaptics audio drivers allows a local authorized attacker to load a DLL in a privileged process. Out of an abundance of caution, this CVE ID is bein…
-
High 7.8
Windows exFAT File System Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows exFAT File System allows an unauthorized attacker to execute code locally.
-
High 7.8
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
-
High 7.8
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Mark of the Web Security Feature Bypass Vulnerability
Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
-
High 7.8
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
-
High 7.3CVE-2025-24076 Public exploit
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
-
High 7.3
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
-
High 7.1
Windows Server Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally.
-
Medium 6.6
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
-
Medium 6.6
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
-
Medium 6.5
Microsoft Windows File Explorer Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.5
Windows NTFS Information Disclosure Vulnerability
Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally.
-
Medium 4.4
DirectX Graphics Kernel File Denial of Service Vulnerability
Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally.
-
Medium 4.3
MapUrlToZone Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 4.3
Windows USB Video Class System Driver Information Disclosure Vulnerability
Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.
Revision history
-
#1.0.0
Initiele versie