Microsoft released Patch Tuesday security updates for July 2025, which addressed 130 flaws, including one a Microsoft SQL Server zero-day.
Microsoft Patch Tuesday security updates for July 2025 addressed 130 vulnerabilities in Windows and Windows Components, Office and Office Components, .NET and Visual Studio, Azure, Teams, Hyper-V, Windows BitLocker, Microsoft Edge (Chromium-based), and the Windows Cryptographic Service.
10 vulnerabilities addressed by the company are rated Critical, and the rest is rated Important in severity.
Only one of the flaws, tracked as CVE-2025-49719, is flagged as a publicly disclosed zero-day vulnerability in Microsoft SQL Server. Below are some of the most interesting issues addressed by Microsoft Patch Tuesday for July 2025:
The vulnerability CVE-2025-49719 (CVSS score of 7.5) is an information disclosure flaw in Microsoft SQL Server that allows remote, unauthenticated attackers to access uninitialized memory due to improper input validation. Microsoft recommends updating SQL Server and installing OLE DB Driver 18 or 19 to fix the issue. The flaw was discovered by Vladimir Aleksic from Microsoft.
The vulnerability CVE-2025-47981 (CVSS score of 9.8) is a critical, wormable RCE issue in Windows SPNEGO NEGOEX. It allows remote attackers to execute code via a malicious message, with no user interaction required. The flaw involves a heap-based buffer overflow and runs with elevated privileges. Microsoft expects active exploitation within 30 days and urges rapid patching.
The vulnerability CVE-2025-49695 (CVSS score of 8.8) is a Microsoft Office RCE vulnerability exploitable via the Preview Pane. It’s one of four similar bugs this month—marking the third month in a row with Critical Office flaws. Mac users remain unprotected, as patches for Office LTSC 2021 and 2024 aren’t yet available. Disabling the Preview Pane is recommended until Microsoft resolves these ongoing issues.
The full list of vulnerabilities addressed by Microsoft in July 2025 is available here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Microsoft Patch Tuesday)
