Patch Tuesday, March 2025
Microsoft's monthly security release, Tuesday, March 11, 2025. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
8 CVEs · 0 critical · 7 exploited · 4 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
8 CVEs · 0 critical · 7 exploited · 4 with public exploit code
- 7.8HighMar 11, 2025Microsoft Windows Memory corruptionCVE-2025-24985Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.Exploited3.9% likelyExploit code
- 7.0HighMar 11, 2025Microsoft WindowsCVE-2025-26633Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.Exploited30% likelyExploit codeExploit-DB
- 6.5MediumMar 11, 2025Microsoft Windows Path traversal / file handlingCVE-2025-24054Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.Exploited62% likelyExploit codeExploit-DBDetection
- 7.8HighMar 11, 2025Microsoft Windows Memory corruptionCVE-2025-24993Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.Exploited2.2% likely
- 7.0HighMar 11, 2025Microsoft Windows Memory corruptionCVE-2025-24983Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.Exploited1.9% likely
- 5.5MediumMar 11, 2025Microsoft Windows Memory corruptionCVE-2025-24991Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.Exploited2% likely
- 4.6MediumMar 11, 2025Microsoft Windows Information disclosureCVE-2025-24984Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.Exploited2% likely
- 6.5MediumMar 11, 2025Microsoft Windows 10 Version 1507 Information disclosureCVE-2025-24071Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.23% likelyExploit-DB
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.