Microsoft’s Patch Tuesday update for May 2025 has addressed a series of high-priority security flaws in Windows Remote Desktop services, which could enable attackers to execute malicious code remotely. Security professionals are advising users to install these updates without delay to protect their systems from possible exploitation.
Among the 72 vulnerabilities fixed this month, two particularly dangerous flaws in Remote Desktop services—CVE-2025-29966 and CVE-2025-29967—are especially noteworthy. These issues are related to heap-based buffer overflows in the Remote Desktop Client and Gateway Service, allowing attackers to run arbitrary code remotely over a network.
According to Microsoft’s advisory, an attacker could exploit these vulnerabilities by controlling a Remote Desktop Server, triggering code execution on the RDP client machine when the victim connects to the malicious server. These vulnerabilities have been assigned “Critical” severity ratings and a high CVSS score, highlighting their potential to cause significant damage.
The flaws exploit weaknesses associated with heap-based buffer overflows (CWE-122), enabling memory corruption that can lead to unauthorized code execution.
Broad Impact Across Systems
These vulnerabilities affect various versions of Windows that use Remote Desktop services. Although no active exploitation has been detected yet, Microsoft has categorized the flaws with an “Exploitation Less Likely” rating at this time.
A cybersecurity expert commented, “Although these vulnerabilities haven’t been exploited so far, Remote Desktop flaws have historically been prime targets for malicious actors. The ability for attackers to gain remote code execution, especially without authentication, makes these vulnerabilities highly risky.”
In addition to the Remote Desktop flaws, the May Patch Tuesday release also included fixes for five zero-day vulnerabilities that were actively being exploited, including issues in Windows DWM Core Library, Windows Common Log File System Driver, and the Windows Ancillary Function Driver for WinSock.
Experts urge both organizations and individual users to implement the latest security patches immediately. The vulnerabilities could be exploited if users connect to a malicious Remote Desktop server, potentially allowing attackers to take full control of the system.
For systems that cannot be patched right away, it is recommended to limit Remote Desktop connections to trusted servers and employ additional network security measures to minimize the risk of attack.
The May 2025 updates can be obtained via Windows Update, WSUS, or the Microsoft Update Catalog.
