Microsoft's Latest 'Patch Tuesday' Fixes 134 Security Vulnerabilities
Microsoft has released its April 2025 Patch Tuesday update, which fixes 134 malicious bugs across its systems—including one zero-day exploit. Windows and Microsoft users should ensure their devices are up to date with the latest patches.
Patch Tuesday updates for April 2025
One of the vulnerabilities fixed this month was a zero-day, which is a flaw that is exploited or publicly disclosed before an official patch is released by developers.
The active exploit—labeled CVE-2025-29824—is an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) Driver. The flaw, which was identified by the Microsoft Threat Intelligence Center, allowed attackers to gain SYSTEM privileges locally. According to reporting from Bleeping Computer, this zero-day was exploited by the RansomEXX ransomware gang.
Microsoft has released a patch for Windows Server and Windows 11 and expects to notify users when security updates for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems.
April's update fixes 49 elevation of privilege flaws, nine security feature bypass flaws, 31 remote code execution flaws, 17 information disclosure flaws, 14 denial of service flaws, and three spoofing flaws.
Eleven of the remote code execution vulnerabilities were categorized as "critical" and were found across Microsoft Office, Microsoft Office Excel, Remote Desktop Gateway Service, Windows Hyper-V, Windows LDAP, and Windows TCP/IP. Microsoft also released patches to vulnerabilities in Mariner and 13 Microsoft Edge bugs this month.
What Microsoft users need to do
Security updates for Windows and Microsoft are usually downloaded and installed automatically, but you can check your PC's status by going to Start > Settings > Windows Update and selecting Check for Windows updates. Patch Tuesday fixes are released on the second Tuesday of every month at 10 a.m. PT, so now is a good time to ensure your system is up to date.