Microsoft July 2025 Patch Tuesday: Major Security Fixes and Zero-Day Patch

Microsoft's July 2025 Patch Tuesday has delivered a substantial security update, addressing 137 vulnerabilities across its product suite, including a publicly disclosed zero-day flaw in Microsoft SQL Server. This comprehensive release underscores the company's ongoing commitment to fortifying its software against an increasingly sophisticated threat landscape.

Breakdown of Vulnerabilities​

The 137 vulnerabilities resolved in this update are categorized as follows:

• Elevation of Privilege Vulnerabilities: 53 instances
• Remote Code Execution (RCE) Vulnerabilities: 41 instances
• Information Disclosure Vulnerabilities: 18 instances
• Security Feature Bypass Vulnerabilities: 8 instances
• Denial of Service (DoS) Vulnerabilities: 6 instances
• Spoofing Vulnerabilities: 4 instances

Notably, 14 of these vulnerabilities are classified as critical, with the majority being RCE flaws that could allow attackers to execute arbitrary code remotely, potentially leading to full system compromise.

Zero-Day Vulnerability: CVE-2025-49719​

The highlight of this month's update is the patch for CVE-2025-49719, an information disclosure vulnerability in Microsoft SQL Server. This flaw arises from improper input validation, enabling unauthenticated attackers to access uninitialized memory over a network. While there have been no reports of active exploitation, the public disclosure of this vulnerability increases the risk of future attacks. Microsoft advises administrators to update their SQL Server instances and ensure that the Microsoft OLE DB Driver is updated to version 18 or 19 to mitigate this risk.

Critical Remote Code Execution Vulnerabilities​

Several critical RCE vulnerabilities have been addressed in this update:

• CVE-2025-47981: A heap-based buffer overflow in the SPNEGO Extended Negotiation (NEGOEX) Security Mechanism, affecting Windows 10 version 1607 and above. Exploitation could allow remote code execution without user interaction, posing a significant threat to systems with default Group Policy settings enabling PKU2U authentication.
• CVE-2025-49704: A code injection vulnerability in Microsoft SharePoint, exploitable remotely by authenticated users over the internet. This flaw could allow attackers to execute arbitrary code within the SharePoint application pool, potentially compromising sensitive data and system integrity.
• CVE-2025-49695 and CVE-2025-49696: Remote code execution vulnerabilities in Microsoft Office, triggered by opening or previewing specially crafted documents. These flaws highlight the importance of caution when handling untrusted documents, as exploitation could lead to arbitrary code execution with the privileges of the user.

AMD Processor Side-Channel Vulnerabilities​

This update also addresses two critical side-channel vulnerabilities affecting AMD processors:

• CVE-2025-36357: A transient execution side-channel vulnerability in the L1 Data Queue, potentially allowing attackers to exfiltrate sensitive data through speculative execution.
• CVE-2025-36350: A similar vulnerability in the Store Queue, which could be exploited to leak information via speculative execution.

These vulnerabilities underscore the need for hardware-level security considerations and prompt firmware updates to mitigate potential risks.

Recommendations for Administrators​

Given the breadth and severity of the vulnerabilities addressed in this update, administrators are strongly advised to:

• Prioritize Patching: Apply the July 2025 security updates promptly, focusing on critical systems such as SQL Server, SharePoint, and Office applications.
• Update Drivers and Firmware: Ensure that all relevant drivers, including the Microsoft OLE DB Driver, are updated to the latest versions. Additionally, apply firmware updates for AMD processors to mitigate side-channel vulnerabilities.
• Review Security Configurations: Assess and, if necessary, reconfigure Group Policy settings related to authentication mechanisms like PKU2U to reduce exposure to potential exploits.
• Educate Users: Reinforce the importance of caution when opening or previewing documents from untrusted sources to prevent exploitation of document-based vulnerabilities.

Conclusion​

Microsoft's July 2025 Patch Tuesday serves as a critical reminder of the ever-evolving cybersecurity landscape and the necessity for proactive defense measures. By addressing a wide array of vulnerabilities, including a publicly disclosed zero-day and several critical RCE flaws, this update plays a pivotal role in safeguarding systems against potential threats. Administrators and users alike must remain vigilant, ensuring that patches are applied promptly and security best practices are upheld to maintain the integrity and security of their computing environments.

---

Source: ÇözümPark Microsoft Temmuz 2025 Patch Tuesday: 1 Zero-Day, 137 Zafiyet Kapatıldı - ÇözümPark