CyberSecurity

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. 

Acknowledgement added. This is an informational change only. 

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. 

Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. 

To comprehensively address CVE-2025-26629, Microsoft has released May 2025 security updates for all affected versions of Microsoft Office. Customers running any of these versions should ensure that they have the latest build installed. For more information and to verify the build version, see https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates. 

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. 

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. 

Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network 

Server-Side Request Forgery (SSRF) in Azure allows an authorized attacker to perform spoofing over a network. 

Improper Authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.