Microsoft’s May 2025 Patch Tuesday delivers 82 updates (addressing 75 new CVEs) across Windows, Office, .NET, Azure and other products. Twelve flaws are rated Critical, and five vulnerabilities were already under active exploit in the wild. The patches include numerous remote code execution (RCE) and privilege escalation flaws in core components from Windows drivers and services to scripting and document engines. Notably, CVE-2025-30397 is a critical scripting-engine memory-corruption bug (a “type confusion” flaw in MSHTML) that forces Edge into Internet Explorer (IE) mode and executes code when a user clicks a malicious link. This CVE-30397 vulnerability has already been exploited in the wild, underscoring the urgency of the update.
This month’s update targets critical flaws across the Microsoft ecosystem, from kernel drivers and graphics subsystems to Office preview handlers and Azure cloud modules. Among the vulnerabilities, several deserve particular attention for their depth of exposure and exploitability.
This vulnerability resides in MSHTML, the legacy scripting engine used by Internet Explorer and still supported via IE Mode in Microsoft Edge. The flaw is categorized as a “type confusion” memory corruption vulnerability. An attacker can exploit it by crafting a malicious HTML page or script file that manipulates how objects are interpreted in memory. When a victim visits the malicious page (for example, via a phishing email or link), the browser processes malformed JavaScript that forces the engine to misinterpret object types. This leads to memory corruption and ultimately remote code execution in the context of the logged-in user.
Even though IE has been deprecated, IE Mode within Microsoft Edge preserves compatibility with many enterprise applications. This compatibility, however, reintroduces the risk surface of legacy components. Because the scripting engine runs with the same privileges as the user, successful exploitation allows attackers to execute payloads such as downloaders, backdoors, or credential stealers especially if the user holds administrative rights.
Multiple EoP vulnerabilities were patched in core Windows components:
These vulnerabilities are particularly dangerous because they require low privileges to exploit but result in full system control. Once SYSTEM access is achieved, attackers can disable security tools, manipulate system settings, or deploy additional payloads such as ransomware.
A significant portion of this month’s CVEs involve the Office suite, including Excel, Outlook, Word, and the Office file preview functionality. These components are frequently targeted by attackers who craft malicious documents embedded with code or malformed objects that trigger vulnerabilities when previewed or opened. Exploitation can occur without user interaction in some cases (preview pane attack surface), making these flaws ideal for phishing campaigns.
Vulnerabilities in Azure File Sync, DevOps Server, and Visual Studio suggest attackers may be probing cloud-service integrations and CI/CD pipelines. Affected flaws could enable remote code execution or information disclosure. While exploitation here may be more complex, successful compromise can lead to manipulation of build environments or exfiltration of sensitive data repositories.
Common Patterns Across CVEs:
The widespread nature of these vulnerabilities affects every type of Microsoft environment workstation, servers, cloud services, and hybrid infrastructures. Active exploitation of five vulnerabilities suggests attackers are already leveraging these flaws in real-world scenarios, through phishing campaigns or drive-by-download attacks.
If exploited, attackers can:
Given the broad applicability and active exploitation, unpatched systems are at high risk of compromise. Even systems not directly connected to the internet may be vulnerable if targeted by a well-crafted phishing campaign or malware dropper.
To defend against these threats, organizations should:
https://msrc.microsoft.com/update-guide/releaseNote/2025-May
