Microsoft's October 2025 Patch Tuesday addresses 172 vulnerabilities, including six zero-day flaws. It also fixes eight 'Critical' vulnerabilities, five of which are remote code execution vulnerabilities and three are elevation of privilege vulnerabilities. Notably, Windows 10 reaches the end of support, with this being the last Patch Tuesday for free updates. Consumers can sign up for Extended Security Updates (ESU) for a year, and enterprises for up to three years. This month's updates fix two publicly disclosed zero-day flaws in Windows SMB Server and Microsoft SQL Server. Microsoft removes an Agere Modem driver that was abused for administrative privileges. The company also addresses a Windows Remote Access Connection Manager flaw, a Secure Boot bypass in IGEL OS, and an AMD flaw impacting memory integrity. Additionally, Microsoft fixes vulnerabilities in various services and components, including Connected Devices Platform Service, Windows Authentication Methods, Windows BitLocker, Windows Bluetooth Service, and more. The list includes vulnerabilities in Microsoft Office, Windows Search Component, Windows Remote Desktop Services, and many others. Microsoft reiterates that the flaws impact all versions of Windows, and the modem is not necessary to exploit the vulnerabilities.
