Microsoft Patch Tuesday October 2025 – 172 Vulnerabilities Fixed Along with 4 Zero-days

Microsoft’s October 2025 Patch Tuesday addressed 172 vulnerabilities across its ecosystem, with four zero-day flaws highlighted, two of which are reportedly being exploited in the wild. The update covers Windows, Microsoft Office, and Azure cloud services, underscoring the ongoing pressure on organisations to keep systems patched.

Among the zero-days, CVE-2025-2884 is an out-of-bounds read in the TPM2.0 reference implementation and was publicly disclosed by CERT/CC; CVE-2025-47827 allows Secure Boot bypass in IGEL OS versions before 11 by exploiting improper signature verification. The other two zero-days, CVE-2025-59234 and CVE-2025-59236, are use-after-free vulnerabilities in Microsoft Office and Excel, respectively, rated critical with high risk for remote code execution.

In total, the October release includes 11 critical RCE and privilege-escalation issues across memory‑safety flaws and legacy code, affecting a wide range of products beyond Windows itself.