Threat intelligence
Microsoft Security Bulletin Coverage for June 2025
Overview
Microsoft’s June 2025 Patch Tuesday includes 66 vulnerabilities, 25 of which are classified as Remote Code Execution (RCE). The SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month and produced protection coverage for eight of the reported vulnerabilities.
Vulnerabilities with Detections
| CVE | CVE Title | Signature |
|---|---|---|
| CVE-2025-32713 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | ASPY 7087Exploit-exe exe.MP_451 |
| CVE-2025-32714 | Windows Installer Elevation of Privilege Vulnerability | ASPY 7088 Exploit-exe exe.MP_452 |
| CVE-2025-33053 | Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability | IPS 21124 Windows WebDAV Remote Code Execution (CVE-2025-33053) |
| CVE-2025-33070 | Windows Netlogon Elevation of Privilege Vulnerability | IPS 21129 Windows Netlogon Elevation of Privilege Vulnerability (CVE-2025-33070) |
| CVE-2025-33071 | Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability | IPS 4513 Windows KDC Proxy Service Remote Code Execution (CVE-2025-33071) |
| CVE-2025-47162 | Microsoft Office Remote Code Execution Vulnerability | ASPY 643 Malformed-xls xls.MP_21 |
| CVE-2025-47164 | Microsoft Office Remote Code Execution Vulnerability | ASPY 642 Malformed-ppt ppt.MP_6 |
| CVE-2025-47167 | Microsoft Office Remote Code Execution Vulnerability | APY 641 Malformed-xls xls.MP_20 |
Release Breakdown
The vulnerabilities can be classified into the following categories:
The June release includes 10 critical vulnerabilities and 56 that are rated important.
Microsoft also tracks vulnerabilities that are either actively exploited or publicly disclosed before the Patch Tuesday release. The chart above highlights these categories as observed this month.
Release Detailed Breakdown
Denial of Service Vulnerabilities
| CVE | CVE Title |
|---|---|
| CVE-2025-32724 | Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability |
| CVE-2025-32725 | DHCP Server Service Denial of Service Vulnerability |
| CVE-2025-33050 | DHCP Server Service Denial of Service Vulnerability |
| CVE-2025-33056 | Windows Local Security Authority (LSA) Denial of Service Vulnerability |
| CVE-2025-33057 | Windows Local Security Authority (LSA) Denial of Service Vulnerability |
| CVE-2025-33068 | Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
Elevation of Privilege Vulnerabilities
| CVE | CVE Title |
|---|---|
| CVE-2025-32712 | Win32k Elevation of Privilege Vulnerability |
| CVE-2025-32713 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2025-32714 | Windows Installer Elevation of Privilege Vulnerability |
| CVE-2025-32716 | Windows Media Elevation of Privilege Vulnerability |
| CVE-2025-32718 | Windows SMB Client Elevation of Privilege Vulnerability |
| CVE-2025-32721 | Windows Recovery Driver Elevation of Privilege Vulnerability |
| CVE-2025-33067 | Windows Task Scheduler Elevation of Privilege Vulnerability |
| CVE-2025-33070 | Windows Netlogon Elevation of Privilege Vulnerability |
| CVE-2025-33073 | Windows SMB Client Elevation of Privilege Vulnerability |
| CVE-2025-33075 | Windows Installer Elevation of Privilege Vulnerability |
| CVE-2025-47955 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
| CVE-2025-47962 | Windows SDK Elevation of Privilege Vulnerability |
| CVE-2025-47966 | Power Automate Elevation of Privilege Vulnerability |
| CVE-2025-47968 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
Information Disclosure Vulnerabilities
| CVE | CVE Title |
|---|---|
| CVE-2025-24065 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-24068 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-24069 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-32715 | Remote Desktop Protocol Client Information Disclosure Vulnerability |
| CVE-2025-32719 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-32720 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-32722 | Windows Storage Port Driver Information Disclosure Vulnerability |
| CVE-2025-33052 | Windows DWM Core Library Information Disclosure Vulnerability |
| CVE-2025-33055 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-33058 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-33059 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-33060 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-33061 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-33062 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-33063 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-33065 | Windows Storage Management Provider Information Disclosure Vulnerability |
| CVE-2025-47969 | Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability |
Remote Code Execution Vulnerabilities
| CVE | CVE Title |
|---|---|
| CVE-2025-29828 | Windows Schannel Remote Code Execution Vulnerability |
| CVE-2025-30399 | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-32710 | Windows Remote Desktop Services Remote Code Execution Vulnerability |
| CVE-2025-33053 | Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability |
| CVE-2025-33064 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2025-33066 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2025-33071 | Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability |
| CVE-2025-47162 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2025-47163 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2025-47164 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2025-47165 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2025-47166 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2025-47167 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2025-47168 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2025-47169 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2025-47170 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2025-47171 | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2025-47172 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2025-47173 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2025-47174 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2025-47175 | Microsoft PowerPoint Remote Code Execution Vulnerability |
| CVE-2025-47176 | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2025-47953 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2025-47957 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2025-47959 | Visual Studio Remote Code Execution Vulnerability |
Security Feature Bypass Vulnerabilities
| CVE | CVE Title |
|---|---|
| CVE-2025-33069 | Windows App Control for Business Security Feature Bypass Vulnerability |
| CVE-2025-47160 | Windows Shortcut Files Security Feature Bypass Vulnerability |
Spoofing Vulnerabilities
| CVE | CVE Title |
|---|---|
| CVE-2025-47956 | Windows Security App Spoofing Vulnerability |
| CVE-2025-47977 | Nuance Digital Engagement Platform Spoofing Vulnerability |
Share This Article
An Article By
An Article By
Security News
Security News
The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.