Full Report
Microsoft has released its monthly security update for September 2025, which includes 86 vulnerabilities affecting a range of products.
Analysis Summary
# Vulnerability: September 2025 Microsoft Patch Summary (Focus on RCE and High-Risk Flaws)
## CVE Details
This summary focuses on the most critical/highlighted vulnerabilities:
| CVE ID | Severity Score | CWE | Notes |
| :--- | :--- | :--- | :--- |
| CVE-2025-54916 | N/A (RCE) | Stack-buffer overflow | RCE |
| CVE-2025-54910 | N/A (RCE) | Heap-based buffer overflow | Local ACE |
| CVE-2025-54918 | N/A (EoP) | Improper Authentication | EoP (Network access to SYSTEM) |
| CVE-2025-54101 | N/A (RCE) | Use-after-free (Race Condition) | RCE over Network |
| CVE-2025-55226 | N/A (RCE) | Improper Synchronization/Race Condition | RCE (Local) |
| CVE-2025-55236 | N/A (RCE) | TOCTOU Race Condition | RCE (Local) |
| CVE-2025-53803 | N/A | Information Disclosure | Likely Exploited |
| CVE-2025-53804 | N/A | Information Disclosure | Likely Exploited |
| CVE-2025-54093 | N/A | Elevation of Privilege | Likely Exploited |
| CVE-2025-54098 | N/A | Elevation of Privilege | Likely Exploited |
| CVE-2025-54110 | N/A | Elevation of Privilege | Likely Exploited |
*Note: Specific CVSS scores were not provided in the source text, only the general types and impact levels.*
## Affected Systems
- **Products:** Windows (Multiple Versions), Microsoft Office, Microsoft 365 Apps, Windows SMB v3 Client/Server, DirectX Graphics Kernel, Windows TCP/IP Driver, Windows Hyper-V.
- **Versions:**
- **Windows (General):** Windows 10, 11, Server 2008, 2012, 2016, 2019, 2022, 2025.
- **Microsoft Office:** Microsoft 365 Apps, Office 2016, 2019, LTSC 2021, LTSC 2024.
- **Configurations:** Specific configurations may be required for certain flaws (e.g., CVE-2025-55226 requires environment preparation).
## Vulnerability Description
Microsoft released 86 vulnerabilities in September 2025. Key flaws include:
* **CVE-2025-54916 (RCE via NTFS):** A stack-buffer overflow in the Windows NTFS subsystem allowing an authorized remote attacker to execute code over the network.
* **CVE-2025-54910 (RCE via Office):** A heap-based buffer overflow in Microsoft Office that allows an unauthorized attacker to achieve Arbitrary Code Execution (ACE) if they can execute code locally.
* **CVE-2025-54918 (EoP via NTLM):** An improper authentication flaw in Windows NTLM allows an authorized remote attacker to elevate privileges to the SYSTEM level over the network.
* **CVE-2025-54101 (RCE via SMBv3):** A use-after-free vulnerability in the Windows SMB v3 Client/Server that necessitates winning a race condition to achieve remote code execution.
* **CVE-2025-55226 & CVE-2025-55236 (RCE via Graphics Kernel):** Two RCE flaws in the DirectX Graphics Kernel. CVE-2025-55226 is caused by improper synchronization, and CVE-2025-55236 is a TOCTOU race condition. Both generally allow local code execution after specific environmental preparation.
* **Other High-Risk Flaws:** Five EoP vulnerabilities and two Information Disclosure vulnerabilities in the Windows Kernel/Drivers were noted as having a high likelihood of exploitation.
## Exploitation
- **Status:** None of the 86 disclosed vulnerabilities were observed being exploited in the wild as of the advisory release. However, eight vulnerabilities (5 EoP, 2 Info Disclosure, 1 RCE) are assessed by Microsoft as having a high likelihood of exploitation.
- **Complexity:** Ranges from Low to Medium/High depending on the specific flaw (e.g., race conditions like in CVE-2025-54101 may increase complexity).
- **Attack Vector:** Varies, including **Network** (CVE-2025-54916, CVE-2025-54101, CVE-2025-54918), **Local** (CVE-2025-54910, CVE-2025-55226, CVE-2025-55236), and localized boundary conditions for Kernel vulnerabilities.
## Impact
| Vulnerability Type | Confidentiality | Integrity | Availability |
| :--- | :--- | :--- | :--- |
| RCE (e.g., CVE-2025-54916) | High | High | High |
| EoP (e.g., CVE-2025-54918) | High (via local access) | High (SYSTEM privileges) | Low/Medium |
| Information Disclosure | High | Low | Low |
| Local RCE (e.g., Graphics Kernel) | High | High | High |
## Remediation
### Patches
Microsoft released security updates for all 86 disclosed vulnerabilities as part of the September 2025 Patch Tuesday. Users must apply the relevant updates provided by Microsoft.
### Workarounds
No specific vendor workarounds were detailed in this summary regarding the specific CVEs, other than the need to install the available security updates.
## Detection
- **Indicators of Compromise:** Related to system crashes, unexpected process execution, or privilege escalation attempts targeting NTFSSecurity, NTLM authentication mechanisms, or SMB traffic manipulation.
- **Detection Methods and Tools:** Cisco Talos released an updated Snort ruleset to help detect attempts to exploit these vulnerabilities:
- **Snort2 Rules:** 65327 – 65334
- **Snort3 Rules:** 301310 – 301313
Cisco Security Firewall customers should update their Security Update Release (SRU).
## References
- Vendor Advisory Page: hxxps://msrc.microsoft.com/update-guide/releaseNote/2025-Sep
- Vendor Advisory (CVE-2025-54916): hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54916
- Vendor Advisory (CVE-2025-54910): hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54910
- Vendor Advisory (CVE-2025-54918): hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54918
- Vendor Advisory (CVE-2025-54101): hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54101
- Vendor Advisory (CVE-2025-55226): hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55226
- Vendor Advisory (CVE-2025-55236): hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55236
- Talos Snort Rule Source: hxxps://snort.org/