Microsoft patches six flaws including V8 RCE
Microsoft's August 2025 update addresses six vulnerabilities across Windows, Edge, and Azure products, including a critical V8 out-of-bounds write allowing remote code execution.
Microsoft released security updates on August 22, 2025, addressing multiple vulnerabilities across its product portfolio. The most severe flaw is CVE-2025-9132, an out-of-bounds write vulnerability in the V8 JavaScript engine used by Chromium-based Edge, which allows remote code execution through a malicious HTML page. A second critical vulnerability, CVE-2025-55231, affects Windows Storage and involves a race condition that permits unauthorized remote code execution.
Additional vulnerabilities include privilege escalation flaws in Azure Databricks (CVE-2025-53763) and Microsoft PC Manager (CVE-2025-53795), a certificate spoofing issue in Windows Certificates (CVE-2025-55229), and a local privilege escalation in the Windows MBT Transport driver (CVE-2025-55230). The advisory covers an extensive range of affected systems including Windows 10, Windows 11, Windows Server editions from 2008 through 2025, Microsoft Edge, and various Azure services.
No active exploitation has been reported for any of these vulnerabilities. Successful exploitation of the remote code execution flaws could allow attackers to gain privileges equivalent to the logged-on user, potentially enabling them to install programs, manipulate data, or create new accounts. MS-ISAC recommends immediate patching after appropriate testing, along with implementing vulnerability management processes and network segmentation controls.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Microsoft Edge (Possible Browser Exploitation)
Detects command/script interpreters or LOLBins spawned directly from Microsoft Edge processes, consistent with post-exploitation activity following a browser RCE such as the V8 out-of-bounds write flaw (CVE-2025-9132) triggered via a malicious HTML page. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from Microsoft Edge (Possible Browser Exploitation)
id: 31f819cc-3b27-5123-84a0-e2eb69888453
status: experimental
description: 'Detects command/script interpreters or living-off-the-land binaries
launched as a direct child process of Microsoft Edge (msedge.exe or its content/renderer
processes). Browser RCE vulnerabilities, such as the V8 engine out-of-bounds write
flaw (CVE-2025-9132), can allow an attacker to achieve code execution in the context
of the logged-on user after the victim opens a malicious HTML page. Legitimate Edge
operation does not spawn shells or scripting engines as direct children.
'
references:
- https://msrc.microsoft.com/update-guide (August 2025 Patch Tuesday)
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \msedge.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_updater:
CommandLine|contains:
- MicrosoftEdgeUpdate
- \Update\
condition: selection_parent and selection_child and not filter_updater
falsepositives:
- Edge browser update or crash-reporting helper processes that legitimately spawn
utility binaries
- Enterprise software deployment tools that inject automation scripts through Edge
for testing
level: high
Browser Launched with Direct URL Argument from Non-Standard Parent (Possible Malicious Link Execution)
Detects Microsoft Edge being launched with a URL command-line argument by an unusual parent process (e.g., email client, chat app, or document reader), indicating a user clicked a malicious link that could lead to exploitation of a browser vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Launched with Direct URL Argument from Non-Standard Parent (Possible
Malicious Link Execution)
id: 2dba7039-24c4-5e64-9bee-b4e3212c3512
status: experimental
description: 'Detects msedge.exe launched with a URL as a command-line argument where
the parent process is an email client, messaging application, or document viewer
rather than the shell or another browser process. This pattern is consistent with
a user clicking a malicious link (T1204.001) that could deliver a page exploiting
a browser vulnerability such as the V8 engine flaw (CVE-2025-9132).
'
references:
- https://msrc.microsoft.com/update-guide (August 2025 Patch Tuesday)
author: Vorant
tags:
- attack.t1204.001
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_child:
Image|endswith: \msedge.exe
CommandLine|contains:
- http://
- https://
selection_parent_suspicious:
ParentImage|endswith:
- \OUTLOOK.EXE
- \Teams.exe
- \slack.exe
- \AcroRd32.exe
- \WINWORD.EXE
- \thunderbird.exe
condition: selection_child and selection_parent_suspicious
falsepositives:
- Legitimate business use of hyperlinks embedded in email, chat messages, or documents
opening in Edge
- Automated link-preview or safe-link rewriting features in enterprise email security
products
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-products-could-allow-for-remote-code-execution_2025-076
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free