Microsoft Patch Tuesday August 2025 Released – 107 Vulnerabilities Fixed Including 36 RCE

The update includes fixes for 90 vulnerabilities, classified as follows: 13 are Critical, 76 are Important, one is Moderate, and one is Low. Notably, none of these vulnerabilities are listed as actively exploited zero-days, which provides some relief for IT administrators.

The vulnerabilities fall into multiple categories, including Remote Code Execution (RCE), Elevation of Privilege (EoP), Information Disclosure, Spoofing, Denial of Service (DoS), and Tampering. Below is a detailed breakdown of the vulnerabilities by category, along with key insights for organizations to prioritize their patching efforts.

On August 12, 2025, Microsoft released its monthly Patch Tuesday security updates, addressing a significant number of vulnerabilities across its product ecosystem.

Remote Code Execution (RCE) Vulnerabilities: 36 Total

Remote Code Execution vulnerabilities dominate this month’s Patch Tuesday, with 36 vulnerabilities patched, 10 of which are rated Critical. These flaws could allow attackers to execute arbitrary code, potentially compromising entire systems. Key RCE vulnerabilities include:

Windows Graphics Component (CVE-2025-50165, Critical): An untrusted pointer dereference in the Microsoft Graphics Component allows unauthorized attackers to execute code over a network.

DirectX Graphics Kernel (CVE-2025-50176, Critical): A type confusion flaw in the Graphics Kernel enables local code execution by an authorized attacker.

Microsoft Office (CVE-2025-53731, CVE-2025-53740, Critical): Multiple use-after-free vulnerabilities in Microsoft Office allow unauthorized attackers to execute code locally.

Microsoft Word (CVE-2025-53733, CVE-2025-53784, Critical): Flaws in Microsoft Word, including incorrect numeric type conversion and use-after-free issues, permit local code execution.

GDI+ (CVE-2025-53766, Critical): A heap-based buffer overflow in Windows GDI+ allows network-based code execution.

Windows Hyper-V (CVE-2025-48807, Critical): An improper restriction of communication channels in Hyper-V enables local code execution.

Microsoft Message Queuing (MSMQ) (CVE-2025-50177, Critical; CVE-2025-53143, CVE-2025-53144, CVE-2025-53145, Important): Multiple vulnerabilities, including use-after-free and type confusion flaws, affect MSMQ, allowing network-based code execution.

Microsoft Excel (CVE-2025-53741, CVE-2025-53759, CVE-2025-53737, CVE-2025-53739, Important): Heap-based buffer overflows and use-after-free issues in Excel enable local code execution.

Windows Routing and Remote Access Service (RRAS) (CVE-2025-49757, CVE-2025-50160, CVE-2025-50162, CVE-2025-50163, CVE-2025-50164, CVE-2025-53720, Important): Heap-based buffer overflows in RRAS allow network-based code execution.

Microsoft Patch Tuesday August 2025 – Vulnerabilities list

The post Microsoft Patch Tuesday August 2025 Released – 107 Vulnerabilities Fixed Including 36 RCE appeared first on Cyber Security News.