Microsoft · ServicingStack update · May 13, 2025
KB5058497: May 2025 cumulative update for Windows 11 24H2
KB5058497, released May 13, 2025, fixes 41 CVEs across 4 products. 5 of them are being exploited (CVE-2025-30397); 5 on CISA KEV. Patch Radar priority: Patch now.
Patch now5 on CISA KEV
CVEs closed
41
4 rated Critical
Exploited
5
CVE-2025-30397
Exploitation more likely
4
Vendor assessment
Highest EPSS
0.3419
98th percentile
Priority of the 41 CVEs
Patch now 5
Urgent 8
High 11
Routine 17
Applies to
| Product | Build after install |
|---|---|
| Windows 11 Version 24H2 for ARM64-based Systems | 26100.3981 |
| Windows 11 Version 24H2 for x64-based Systems | 26100.3981 |
| Windows Server 2025 | 26100.3981 |
| Windows Server 2025 (Server Core installation) | 26100.3981 |
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2025-30397 | Microsoft Scripting Engine | Remote Code Execution | 7.5 | 0.2726 | KEVExploited |
| Patch now | CVE-2025-32706 | Windows Common Log File System Driver | Elevation of Privilege | 7.8 | 0.0233 | KEVExploited |
| Patch now | CVE-2025-30400 | Windows DWM | Elevation of Privilege | 7.8 | 0.0192 | KEVExploited |
| Patch now | CVE-2025-32709 | Windows Ancillary Function Driver for WinSock | Elevation of Privilege | 7.8 | 0.0182 | KEVExploited |
| Patch now | CVE-2025-32701 | Windows Common Log File System Driver | Elevation of Privilege | 7.8 | 0.0142 | KEVExploited |
| Urgent | CVE-2025-30388 | Windows Win32K - GRFX | Remote Code Execution | 7.8 | 0.0438 | More likely |
| Urgent | CVE-2025-29966 | Windows Remote Desktop | Remote Code Execution | 8.8 | 0.0143 | Exploitation Less Likely |
| Urgent | CVE-2025-29967 | Remote Desktop Gateway Service | Remote Code Execution | 8.8 | 0.0134 | Exploitation Less Likely |
| Urgent | CVE-2025-32710 | Windows Remote Desktop Services | Remote Code Execution | 8.1 | 0.0108 | Exploitation Less Likely |
| Urgent | CVE-2025-24063 | Windows Kernel | Elevation of Privilege | 7.8 | 0.0072 | More likely |
| Urgent | CVE-2025-30385 | Windows Common Log File System Driver | Elevation of Privilege | 7.8 | 0.0053 | More likely |
| Urgent | CVE-2025-29833 | Windows Virtual Machine Bus | Remote Code Execution | 7.7 | 0.0046 | Exploitation Less Likely |
| Urgent | CVE-2025-29841 | Universal Print Management Service | Elevation of Privilege | 7.0 | 0.0040 | More likely |
| High | CVE-2025-29962 | Windows Media | Remote Code Execution | 8.8 | 0.1559 | Exploitation Less Likely |
| High | CVE-2025-26677 | Remote Desktop Gateway Service | Denial of Service | 7.5 | 0.0180 | Exploitation Less Likely |
| High | CVE-2025-29969 | Windows Fundamentals | Remote Code Execution | 7.5 | 0.0116 | Exploitation Less Likely |
| High | CVE-2025-29963 | Windows Media | Remote Code Execution | 8.8 | 0.0109 | Exploitation Less Likely |
| High | CVE-2025-29964 | Windows Media | Remote Code Execution | 8.8 | 0.0109 | Exploitation Unlikely |
| High | CVE-2025-29831 | Remote Desktop Gateway Service | Remote Code Execution | 7.5 | 0.0101 | Exploitation Unlikely |
| High | CVE-2025-47955 | Windows Remote Access Connection Manager | Elevation of Privilege | 7.8 | 0.0091 | Exploitation Less Likely |
| High | CVE-2025-29970 | Microsoft Brokering File System | Elevation of Privilege | 7.8 | 0.0053 | Exploitation Less Likely |
| High | CVE-2025-29842 | UrlMon | Security Feature Bypass | 7.5 | 0.0044 | Exploitation Less Likely |
| High | CVE-2025-29838 | Windows Drivers | Elevation of Privilege | 7.4 | 0.0039 | Exploitation Unlikely |
| High | CVE-2025-27468 | Windows Secure Kernel Mode | Elevation of Privilege | 7.0 | 0.0026 | Exploitation Less Likely |
| Routine | CVE-2025-30394 | Remote Desktop Gateway Service | Denial of Service | 5.9 | 0.3419 | Exploitation Unlikely |
Showing 1 to 25 of 41
1Next