March 2025 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s March 2025 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1147 as soon as coverage is completed.

In-The-Wild & Disclosed CVEs

CVE-2025-26633

According to Microsoft, improper neutralization in Microsoft Management Console could allow an unauthorized attacker to bypass a security feature locally. For those unfamiliar with “Improper Neutralization”, it is based on CWE-707, which Microsoft has associated with this vulnerability even though MITRE discourages mapping against it. Readers may better know this as Improper Input Validation or Improper Output Encoding, both of which are children of CWE-707. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-24983

This vulnerability allows for local privilege escalation to SYSTEM for an authenticated user via the Windows Win32 Kernel Subsystem, however it does require winning a race condition. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-24984

An interesting vulnerability, this CVE requires that the attacker has physical access to a system to plug in a malicious USB drive. With that access, inserting data into an NTFS log file could lead to information disclosure, allowing the attacker to read portions of heap memory. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-24985

An integer overflow in the Windows Fast FAT Driver could lead to code execution if an attacker can convince a local user to mount a malicious VHD (Virtual Hard Disk). Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-24991

This CVE almost feels like a combination of CVE-2025-24984 and CVE-2025-24985. An attacker must convince a local user to mount a malicious VHD, which would trigger an out-of-bounds read in NTFS, disclosing portions of heap memory. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-24993

A heap-based buffer overflow in NTFS could allow for code execution if an attacker is able to successfully convince a local user to mount a malicious VHD. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-26630

A code execution vulnerability exists within Microsoft Access that requires an attacker to convince a local user to open a malicious Access document. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also color coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted.

Other Information

At the time of publication, there were no new advisories included with the March Security Guidance.