Vulnerability
The latest Vulnerability coverage — news, analysis, and updates from the WindowsNews.AI desk.
CVE-2025-53741: Microsoft Issues Emergency Excel Patch to Stop Remote Code Execution via Heap Overflow
Microsoft has disclosed a critical heap-based buffer overflow vulnerability in Excel, tracked as CVE-2025-53741, that can give attackers the ability to remotely execute code on a vulnerable machine...
Microsoft Fixes SQL Server Flaw That Allows Privilege Escalation via SQL Injection
Microsoft’s July 2025 Patch Tuesday release includes a fix for a high-severity SQL injection vulnerability in SQL Server that enables authenticated attackers to escalate privileges and seize...
Microsoft Patches Azure File Sync EoP Vulnerability CVE-2025-29973—What IT Admins Must Do Now
Microsoft has confirmed an elevation-of-privilege vulnerability in its Azure File Sync service that could allow an authenticated local attacker to gain full control of affected Windows servers....
Critical 8.4 CVSS Flaws in Ashlar-Vellum Cobalt/Xenon/Argon Allow Code Execution via Malicious CAD Files
A CISA advisory published this week warns that multiple Ashlar‑Vellum professional CAD and 3D modeling applications harbor memory‑corruption vulnerabilities carrying a CVSS v4 base score of 8.4....
Zero-Click Data Leak in Microsoft 365 Copilot BizChat Exposes Enterprise Secrets
A newly disclosed vulnerability in Microsoft 365 Copilot BizChat can expose sensitive business information without any user interaction, Microsoft warned in a security advisory published this week....
Microsoft Confirms Critical Azure OpenAI Privilege Escalation Flaw, Urges Vigilance Until Patch
{ "title": "Microsoft Confirms Critical Azure OpenAI Privilege Escalation Flaw, Urges Vigilance Until Patch", "content": "Microsoft has officially acknowledged a critical security vulnerability...
CVE-2025-53792: Azure Portal Privilege Escalation Bug Could Lead to Full Cloud Control
Microsoft has released a security update for CVE-2025-53792, a critical elevation-of-privilege vulnerability in the Azure Portal that allows authenticated attackers to bypass role-based access...
CVE-2025-8579: Google Patches Critical Gemini Live Flaw—Edge Users Must Update Too
CVE-2025-8579, a critical security flaw in Google Chrome's Gemini Live feature, has been patched after four months of quiet danger. The vulnerability, reported by researcher Alesandro Ortiz on April...
Chrome 139 Patches UI Spoofing Flaw That Tricks Users Into Giving Away Permissions—Edge Users Are Protected Too
Google has shipped a critical security fix for Chrome that plugs a user interface spoofing hole attackers could use to trick people into giving websites access to their camera, microphone, or...
CVE-2025-8581: The Low-Risk Chrome Extension Bug That Still Requires an Immediate Update on Edge and Chrome
Google has patched a security vulnerability in Chrome’s Extensions framework that could have allowed attackers to siphon sensitive cross-origin data from unsuspecting users. Tracked as...
CVE-2025-8578: Chrome Cast Vulnerability Sparks Urgent Updates for Chrome and Edge
A critical use-after-free vulnerability in Google Chrome’s Cast component, tracked as CVE-2025-8578, has been patched by both Google and Microsoft, after researchers confirmed that attackers could...
Critical CVE-2025-8582 DOM Vulnerability Patched in Chrome and Edge – Users Urged to Update
On August 5, 2025, Google shipped an urgent security update for Chrome that plugs a dangerous hole in the browser's Document Object Model (DOM) handling. Tracked as CVE-2025-8582, the vulnerability...