This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Microsoft fixes 86 vulnerabilities in Patch Tuesday
As part of "Patch Tuesday", Microsoft released fixes for 86 vulnerabilities. The most severe ones are described below; the full list is available at [1] or in the SANS overview table [2].
Due to deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC), an unauthenticated remote attacker can execute code without authorization [3].
The vulnerability is present in product:
- Microsoft High Performance Compute Pack;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-55232 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to an integer overflow or wraparound vulnerability in Windows Routing and Remote Access Service (RRAS), an unauthenticated remote attacker can execute code [4].
The vulnerability is present in product:
- Windows Routing and Remote Access Service;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-54106 at cve.org, NVD
- CWE-190: Integer Overflow or Wraparound at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to an integer overflow or wraparound vulnerability in Windows Kernel, an authenticated local attacker can elevate their privileges to SYSTEM level [5].
The vulnerability is present in product:
- Windows Kernel;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-54110 at cve.org, NVD
- CWE-190: Integer Overflow or Wraparound at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to deserialization of untrusted data in Microsoft Office SharePoint, an authenticated remote attacker can execute code [6].
The vulnerability is present in product:
- Microsoft SharePoint;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-54897 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to a heap-based buffer overflow vulnerability in Microsoft Office, an unauthenticated local attacker can execute code [7].
The vulnerability is present in product:
- Microsoft Office;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-54910 at cve.org, NVD
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to improper authentication in the Windows NTLM protocol, an authenticated remote attacker can elevate their privileges to SYSTEM level [8].
The vulnerability is present in product:
- Windows NTLM;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-54918 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to improper neutralization of special elements in commands in Microsoft SQL Server, an authenticated remote attacker can elevate their privileges [9].
The vulnerability is present in product:
- Microsoft SQL Server;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-55227 at cve.org, NVD
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to improper authentication in Windows SMB, an unauthenticated remote attacker can perform relay attacks and elevate their privileges [10].
The vulnerability is present in product:
- Windows SMB Server;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-55234 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to improper access control in Azure Windows Virtual Machine Agent, an authenticated local attacker can elevate their privileges to NT AUTHORITY/SYSTEM and execute arbitrary code [11].
The vulnerability is present in product:
- Azure Windows Virtual Machine Agent;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-49692 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Due to a use-after-free vulnerability in Windows BitLocker, an authenticated local attacker can elevate their privileges [12].
The vulnerability is present in product:
- Windows BitLocker;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2025-54912 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 9. 9. 2025.
Links
- [1] https://msrc.microsoft.com/update-guide/releaseNote/2025-Sep
- [2] https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+September+2025/32270/
- [3] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-55232
- [4] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-54106
- [5] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-54110
- [6] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-54897
- [7] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-54910
- [8] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-54918
- [9] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-55227
- [10] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-55234
- [11] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49692
- [12] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-54912
By CESNET, z.s.p.o. Michaela Jarošová on 15. 9. 2025.