{"id":1055,"date":"2025-04-10T01:42:02","date_gmt":"2025-04-10T01:42:02","guid":{"rendered":"https:\/\/www.batteryone.co\/blog\/?p=1055"},"modified":"2025-04-10T01:42:02","modified_gmt":"2025-04-10T01:42:02","slug":"microsofts-april-security-update-fixes-124-vulnerabilities-including-a-dangerous-zero-day-and-wormable-ldap-bugs","status":"publish","type":"post","link":"https:\/\/www.batteryone.co\/blog\/archives\/1055","title":{"rendered":"Microsoft\u2019s April Security Update Fixes 124 Vulnerabilities \u2014 Including a Dangerous Zero-Day and Wormable LDAP Bugs"},"content":{"rendered":"\n

Microsoft has released its April patch bundle, addressing a massive 124 Common Vulnerabilities and Exposures (CVEs)<\/strong> across its software stack. Among these, 11 are rated critical<\/strong>, two are low severity<\/strong>, and the remainder are considered important. While the volume alone makes this update noteworthy, it\u2019s the nature of a few key vulnerabilities that warrants special attention.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Security researchers are particularly concerned about CVE-2025-29824<\/strong>, a privilege escalation flaw<\/strong> in the Windows Common Log File System (CLFS)<\/strong> driver that has been confirmed as actively exploited in the wild. The vulnerability allows attackers to execute code with System-level privileges<\/strong>, giving them near-complete control over a compromised machine. Dustin Childs of the Zero Day Initiative highlighted the issue in a recent blog post, noting that while this is the only known in-the-wild exploit in the April release, it\u2019s nonetheless a serious threat.<\/p>\n\n\n\n

>>>2000mAh ER6 Replacement Battery for Maxell ER6<\/a><\/p>\n\n\n\n

\u201cThese types of bugs are often paired with code execution exploits to take over a system,\u201d Childs wrote, emphasizing that Microsoft has not disclosed the extent of the active exploitation.<\/p>\n\n\n\n

The presence of this zero-day is particularly concerning given the track record of the CLFS driver, which has been a repeated source of critical vulnerabilities in recent years. Adam Barnett, lead software engineer at Rapid7, echoed this concern, noting that the exploit appears to have been discovered outside of Microsoft, even though the company\u2019s own threat intelligence team successfully reproduced it. The advisory does not explicitly state the privilege level achieved, but Barnett suggests it’s safe to assume System access<\/strong> \u2014 a common outcome for past CLFS-related vulnerabilities.<\/p>\n\n\n\n

In addition to the zero-day, two other vulnerabilities stand out for their potential scale and impact: CVE-2025-26663<\/strong> and CVE-2025-26670<\/strong>. Both affect Microsoft’s implementation of LDAP (Lightweight Directory Access Protocol)<\/strong>. According to Childs, these flaws allow an unauthenticated attacker to remotely execute code on affected systems simply by sending a specially crafted LDAP message.<\/p>\n\n\n\n

\u201cThese bugs are wormable,\u201d Childs warned, referring to their ability to propagate automatically without human interaction \u2014 a key feature that makes them especially dangerous in enterprise environments. “Since just about everything can host an LDAP service, there\u2019s a plethora of targets out there.”<\/p>\n\n\n\n

Barnett also flagged the implications for defenders, especially those responsible for enterprise networks running Microsoft infrastructure. \u201cDefenders responsible for an LDAP server \u2014 which means almost any organisation with a non-trivial Microsoft footprint \u2014 should add patching for CVE-2025-26663 to their to-do list,\u201d he said.<\/p>\n\n\n\n

Interestingly, CVE-2025-26670<\/strong> affects the LDAP client<\/strong>, not just the server, suggesting that even systems initiating connections to malicious LDAP servers could be at risk. However, Microsoft’s advisory has caused some confusion. The FAQ section claims exploitation requires sending specially crafted requests to<\/em> a vulnerable server, which seems inconsistent with the nature of a client-side flaw. Barnett noted this inconsistency, suggesting the advisory may be updated for clarification.<\/p>\n\n\n\n

>>>3400mAh BP0002 Replacement Battery for Benco PHONE<\/a><\/p>\n\n\n\n

Beyond these headline vulnerabilities, the broader list of CVEs touches nearly every corner of Microsoft\u2019s ecosystem. According to Childs, the affected components include:<\/p>\n\n\n\n