For thus few patches from Microsoft this month (57), we’ve seven zero-days to handle (with a “Patch Now” advice for Home windows) and normal launch schedules for Microsoft Workplace, Microsoft browsers (Edge) and Visible Studio.
Adobe is again with a essential replace for Reader, however it’s not been paired (at the least for now) with a Microsoft patch.
To navigate what’s modified, the workforce from Readiness has crafted this convenient infographic detailing the dangers of deploying these updates to every platform. (And right here’s a take a look at the final six months of Patch Tuesday releases.)
Recognized points
Microsoft continues to be coping with reported gaming points (Roblox) and has two new recognized points for this launch cycle, together with:
- Home windows 11: After putting in the March replace, USB-connected dual-mode printers supporting each USB Print and IPP Over USB could print random textual content, community instructions, and weird characters, usually beginning with “POST /ipp/print HTTP/1.1.” This concern might be mitigated utilizing Recognized Problem Rollback (KIR).
- Home windows 10: After putting in Home windows updates from Jan. 14, 2025 or later, the Home windows Occasion Viewer may log an error associated to SgrmBroker.exe as Occasion 7023, although this doesn’t set off any seen notifications. This error happens as a result of the System Guard Runtime Monitor Dealer Service, initially a part of Microsoft Defender and not in use, conflicts with the replace throughout initialization. In accordance with Microsoft, this reported concern doesn’t influence system efficiency, performance, or safety, because the service is already disabled in different supported Home windows variations.
Following earlier studies of Citrix-related replace points, gadgets with Citrix Session Recording Agent (SRA) model 2411 may (nonetheless) be unable to finish the set up of the January 2025 Home windows safety replace, inflicting the system to revert to earlier updates after a restart. Affected gadgets may initially obtain and apply the replace, however an error message stating “One thing didn’t go as deliberate” seems throughout set up. This concern is predicted to have an effect on solely a restricted variety of organizations, as model 2411 of SRA is newly launched, and residential customers will not be affected. Don’t rely on this concern being fastened quickly, people.
Main revisions and mitigations
Microsoft has not launched or documented any mitigations or workarounds for the present set of updates. As of now, the next Chromium patches have been revised and re-released:
- CVE-2025-1920: Kind Confusion in V8 (Chromium)
- CVE-2025-2135: Kind Confusion in V8 (Chromium)
- CVE-2025-2136: Use After Free in Inspector (Chromium)
- CVE-2025-2137: Out of Bounds Learn in V8 (Chromium)
- CVE-2025-24201: Out of Bounds Write in GPU on Mac (Chromium)
Home windows lifecycle and enforcement updates
Microsoft is retiring a number of merchandise this month:
- Microsoft SQL Server 2019, which ended mainstream assist on Feb. 28.
- Microsoft Skype, which will probably be terminated (with prejudice) in Might.
- Home windows Distant Desktop , which will probably be changed subsequent month with the Home windows App. (Word: there are nonetheless some lacking options and a number of recognized points reported on this launch.)
Over the following few weeks, a number of Microsoft merchandise are scheduled to succeed in their end-of-life (EOL), and can not obtain safety updates, non-security updates, or technical assist together with:
- April 2, 2025: Dynamics 365 Enterprise Central on-premises (2023 launch wave 2, model 23.x).
- April 8, 2025: Dynamics GP 2015/Dynamics GP 2015 R2.
- April 9, 2025: Microsoft Configuration Supervisor, Model 2309.
Every month, the Readiness workforce analyzes the most recent Patch Tuesday updates and supplies detailed, actionable testing steering based mostly on a big utility portfolio and a complete evaluation of the patches and their potential influence on Home windows and utility deployments.
For this launch cycle, there are not any reported useful adjustments. Nevertheless, characteristic stage testing will nonetheless be required, particularly for system drivers and core libraries. As a consequence of these low-level system (kernel) adjustments, a full reboot/restart check will probably be required for all Home windows UI components together with Explorer, desktop shell and Web Explorer.
We’ve grouped the essential updates and required testing efforts into totally different useful areas, together with:
File System parts
- Widespread Log File System: Check by making a BLF and a number of container information, appending logs utilizing `ReserveAndAppendLog,` after which deleting the containers.
- Core System drivers (ntfs.sys, exfat.sys & fastfat.sys): Check mounting, dismounting, and performing file operations on ExFAT volumes.
Networking and distant providers
- If utilizing a Routing and Distant Entry Service (RRAS) server, check `netsh` situations to verify instructions work as anticipated.
- FAX: Validate TAPI initialization, shutdown, and key features like `lineInitialize` and `lineMakeCall.` Stress check for stability and error dealing with.
Storage and gadget interplay
- Concentrate on storage subsystem assessments, together with operations on digital/bodily disks and storage enclosures.
- Check how Search Connector information work together with varied community paths (UNC, SMB, and file system paths).
- Validate all camera-related situations.
Audio, video and UI parts
- Confirm audio/video recording with inner and exterior gadgets.
- Check apps like Groups and Digicam that use digital options (for instance, Telephone Hyperlink, Home windows Studio Results).
Affected Variations for this replace cycle embrace the next Home windows desktop and server builds:
- Home windows 11 24H2, 23H2, 22H2, Home windows 10 1607, Home windows 10 RTM.
- Home windows Server 23H2, Azure Stack OS 22H2, Home windows Server 2022
Every month, we break down the replace cycle into product households (as outlined by Microsoft) with the next primary groupings:
- Browsers (Microsoft IE and Edge)
- Microsoft Home windows (each desktop and server)
- Microsoft Workplace
- Microsoft Change and SQL Server
- Microsoft Developer Instruments (Visible Studio and .NET)
- Adobe (for those who get this far)
Browsers
Microsoft launched 10 low-profile (no score) updates to its Chromium-based Edge browser. These adjustments might be added to your normal launch calendar.
Microsoft Home windows
The next Home windows product areas have been up to date with 5 essential patches and 32 others rated necessary for this month’s cycle:
- CVE-2025-24035: Home windows Distant Desktop Providers Distant Code Execution Vulnerability
- CVE-2025-24064: Home windows Area Title Service Distant Code Execution Vulnerability
- CVE-2025-24084: Home windows Subsystem for Linux (WSL2) Kernel Distant Code Execution Vulnerability
- CVE-2025-26645: Distant Desktop Consumer Distant Code Execution Vulnerability
Sadly, three of those updates (CVE-2025-24984, CVE-2025-24984 and CVE-2025-24984) have been reported as exploited. Add these Home windows updates to your “Patch Now” schedule.
Microsoft Workplace
Microsoft launched a single essential replace (CVE-2025-24057) and 10 patches rated necessary for the Workplace platform. The entire necessary updates have an effect on Microsoft Phrase, Excel and Entry with no studies of disclosures or exploitation. Add these Microsoft Workplace updates to your normal launch calendar.
Microsoft Change and SQL Server
There have been no updates for both Microsoft Change or SQL Server this March replace cycle.
Developer instruments
Microsoft launched 5 patches, all rated necessary, that have an effect on Microsoft Visible studio and ASP.NET. Add these updates to your normal developer launch schedule.
Adobe (and third-party updates)
This month, Adobe launched a safety replace (APSB25-14) for Acrobat and Reader for Home windows and macOS that addresses six essential and three necessary vulnerabilities. Profitable exploitation may result in arbitrary code execution and reminiscence leak. Adobe isn’t conscious of any exploits within the wild for any of the problems. For some motive this replace was not included on this Microsoft patch cycle. Perhaps that’s correctly.
