Overview

• Microsoft reports no in-the-wild exploitation for this release and flags eight vulnerabilities as more likely to be targeted.
• CVE-2025-54916 is a Windows NTFS remote code execution flaw enabling network-based code execution by an authorized attacker across many Windows client and server versions.
• CVE-2025-54910 is a Microsoft Office remote code execution bug that enables local code execution by an unauthorized attacker and affects Microsoft 365 Apps, Office 2016 and 2019, and LTSC 2021 and 2024.
• CVE-2025-54101 is an SMB v3 client/server use-after-free requiring a race win for RCE, and DirectX Graphics kernel issues CVE-2025-55226 and CVE-2025-55236 involve concurrency and TOCTOU flaws that allow local code execution.
• Cisco Talos published Snort2 rules 65327–65334 and Snort3 rules 301310–301313 and noted more rules may follow, while highlighting additional Microsoft-rated likely targets including CVE-2025-53803, 53804, 54093, 54098 and 54110.