Patch Tuesday: Microsoft Fixes 86 Flaws, Including 9 Critical and 2 Zero-Days (CVE-2025-55234 & CVE-2024-21907)

Microsoft’s September 2025 Patch Tuesday fixed 86 vulnerabilities across Windows, Office, SQL Server, Hyper-V, NTLM, TCP/IP and graphics components, including two zero-days and nine rated critical. In total, the updates address 41 elevation of privilege issues, 22 remote code execution flaws, 16 information disclosure problems, 3 denial of service vulnerabilities, 2 security feature bypasses and 1 spoofing vulnerability.

Two zero-days were addressed: CVE-2025-55234, a Windows SMB elevation of privilege flaw, and CVE-2024-21907, a denial‑of‑service vulnerability in the Newtonsoft.Json library used by SQL Server.

The list of critical CVEs also includes CVE-2025-54918 (Windows NTLM elevation of privilege), CVE-2025-55226 (Graphics Kernel RCE), CVE-2025-55228 (Graphics Component RCE), CVE-2025-55236 (DirectX Graphics Kernel RCE), CVE-2025-53799 (Windows Imaging Component information disclosure), CVE-2025-53800 (Graphics Component EoP), CVE-2025-54910 (Office RCE), CVE-2025-55224 (Hyper-V RCE) and CVE-2025-54914 (Azure Networking EoP).

Administrators are advised to prioritise deployment, particularly across enterprise environments relying on NTLM, Hyper-V and Microsoft Office, and the article notes the findings were reported as part of Microsoft’s patch guidance published on 10 September 2025.