In the USA, federal agencies must address exploited Windows flaws by 4 November amid the end of Windows 10 support.
In the October 2025 Patch Tuesday, Microsoft has addressed 183 security vulnerabilities, coinciding with the termination of standard support for Windows 10 — now limited to devices under the Extended Security Updates program.
The patches cover a range of issues: 165 rated Important, 17 Critical, and one Moderate. Elevation of privilege bugs dominate with 84 instances, followed by remote code execution (33), information disclosure (28), spoofing (14), denial-of-service (11), and security bypasses (11). Eight are non-Microsoft CVEs. Separately, 25 Chromium-based flaws were fixed in Edge since September’s updates.
Two zero day vulnerabilities in Windows are under exploitation, both enabling attackers to gain higher privileges:
- CVE-2025-24990 (CVSS 7.8): Affects the Agere Modem Driver (ltmdm64.sys), a legacy component pre-installed on every Windows version from older editions up to Server 2025, even if unused. Experts highlight its risk due to universal presence, allowing low-privileged users to escalate to admin level. Microsoft plans to eliminate the driver instead of patching it.
- CVE-2025-59230 (CVSS 7.8): Targets the Remote Access Connection Manager (RasMan). This marks the first zero-day exploit in RasMan, though over 20 related issues have been patched since early 2022.
A third exploited flaw, CVE-2025-47827 (CVSS 4.6), involves a Secure Boot bypass in IGEL OS versions before 11. Disclosed publicly in June 2025, it requires physical access, potentially enabling rootkit deployment and credential theft in virtual desktop setups via “evil maid” attacks.
These vulnerabilities have been listed in CISA’s Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by 4 November, 2025.
Other notable critical issues addressed
Flaws with top CVSS scores are CVE-2025-49708 (9.9) in Microsoft Graphics Component, permitting VM escapes from guest to host with SYSTEM privileges, compromising all VMs on a server; and CVE-2025-55315 (9.9) in ASP.NET, allowing authenticated users to evade controls by embedding malicious requests. The remainder are:
- CVE-2025-59287 (CVSS 9.8): Remote code execution in Windows Server Update Service (WSUS).
- CVE-2025-2884 (CVSS 5.3): Out-of-bounds read in TPM 2.0’s reference implementation.
- CVE-2025-59295 (CVSS 8.8): Remote code execution via malformed URLs in Windows parsing, which could overwrite data and redirect execution to attacker-controlled code.
Security researchers emphasize prioritizing these fixes, as exploits could undermine virtualization isolation or legacy components. Beyond Microsoft, various vendors have issued updates for their products in recent weeks to mitigate similar risks.
