These Remote Desktop vulnerabilities were among 72 flaws addressed in Microsoft’s May Patch Tuesday, which also fixed five actively exploited zero-day vulnerabilities, including issues in Windows DWM Core Library, Windows Common Log File System Driver, and Windows Ancillary Function Driver for WinSock. Microsoft’s May 2025 Patch Tuesday has addressed several critical vulnerabilities in Windows Remote Desktop services that could allow attackers to execute malicious code remotely. “In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution on the RDP client machine when a victim connects to the attacker’s server with the vulnerable Remote Desktop Client,” Microsoft explained in its security advisory. CVE-2025-29966 and CVE-2025-29967 both involve heap-based buffer overflow vulnerabilities in the Remote Desktop Client and Gateway Service, respectively, allowing unauthorized attackers to execute arbitrary code over a network. “Although these particular vulnerabilities haven’t been exploited yet, similar Remote Desktop flaws have been prime targets for attackers in the past,” said a cybersecurity researcher familiar with the matter. For systems that cannot be immediately patched, experts suggest limiting Remote Desktop connections to trusted servers only and implementing additional network security measures to restrict potential attack vectors. Among the 72 flaws fixed in this month’s security update, two critical Remote Desktop vulnerabilities stand out as particularly concerning. The vulnerabilities impact multiple versions of Windows operating systems that utilize Remote Desktop services. The vulnerability could be exploited when users connect to malicious Remote Desktop servers, putting client machines at risk of complete system compromise. The May 2025 security updates are available through Windows Update, Windows Server Update Services (WSUS), and the Microsoft Update Catalog.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 14 May 2025 03:10:05 +0000