Microsoft patches six flaws including V8 RCE
Microsoft's August 2025 update addresses six vulnerabilities across Windows, Edge, and Azure products, including a critical V8 out-of-bounds write allowing remote code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Microsoft released security updates on August 22, 2025, addressing multiple vulnerabilities across its product portfolio. The most severe flaw is CVE-2025-9132, an out-of-bounds write vulnerability in the V8 JavaScript engine used by Chromium-based Edge, which allows remote code execution through a malicious HTML page. A second critical vulnerability, CVE-2025-55231, affects Windows Storage and involves a race condition that permits unauthorized remote code execution.
Additional vulnerabilities include privilege escalation flaws in Azure Databricks (CVE-2025-53763) and Microsoft PC Manager (CVE-2025-53795), a certificate spoofing issue in Windows Certificates (CVE-2025-55229), and a local privilege escalation in the Windows MBT Transport driver (CVE-2025-55230). The advisory covers an extensive range of affected systems including Windows 10, Windows 11, Windows Server editions from 2008 through 2025, Microsoft Edge, and various Azure services.
No active exploitation has been reported for any of these vulnerabilities. Successful exploitation of the remote code execution flaws could allow attackers to gain privileges equivalent to the logged-on user, potentially enabling them to install programs, manipulate data, or create new accounts. MS-ISAC recommends immediate patching after appropriate testing, along with implementing vulnerability management processes and network segmentation controls.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Microsoft Edge (Possible Browser Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command/script interpreters or LOLBins spawned directly from Microsoft Edge processes, consistent with post-exploitation activity following a browser RCE such as the V8 out-of-bounds write flaw (CVE-2025-9132) triggered via a malicious HTML page. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from Microsoft Edge (Possible Browser Exploitation)
id: 31f819cc-3b27-5123-84a0-e2eb69888453
status: experimental
description: 'Detects command/script interpreters or living-off-the-land binaries
launched as a direct child process of Microsoft Edge (msedge.exe or its content/renderer
processes). Browser RCE vulnerabilities, such as the V8 engine out-of-bounds write
flaw (CVE-2025-9132), can allow an attacker to achieve code execution in the context
of the logged-on user after the victim opens a malicious HTML page. Legitimate Edge
operation does not spawn shells or scripting engines as direct children.
'
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \msedge.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_updater:
CommandLine|contains:
- MicrosoftEdgeUpdate
- \Update\
condition: selection_parent and selection_child and not filter_updater
falsepositives:
- Edge browser update or crash-reporting helper processes that legitimately spawn
utility binaries
- Enterprise software deployment tools that inject automation scripts through Edge
for testing
level: high
Browser Launched with Direct URL Argument from Non-Standard Parent (Possible Malicious Link Execution)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Microsoft Edge being launched with a URL command-line argument by an unusual parent process (e.g., email client, chat app, or document reader), indicating a user clicked a malicious link that could lead to exploitation of a browser vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Launched with Direct URL Argument from Non-Standard Parent (Possible
Malicious Link Execution)
id: 2dba7039-24c4-5e64-9bee-b4e3212c3512
status: experimental
description: 'Detects msedge.exe launched with a URL as a command-line argument where
the parent process is an email client, messaging application, or document viewer
rather than the shell or another browser process. This pattern is consistent with
a user clicking a malicious link (T1204.001) that could deliver a page exploiting
a browser vulnerability such as the V8 engine flaw (CVE-2025-9132).
'
author: Vorant
tags:
- attack.t1204.001
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_child:
Image|endswith: \msedge.exe
CommandLine|contains:
- http://
- https://
selection_parent_suspicious:
ParentImage|endswith:
- \OUTLOOK.EXE
- \Teams.exe
- \slack.exe
- \AcroRd32.exe
- \WINWORD.EXE
- \thunderbird.exe
condition: selection_child and selection_parent_suspicious
falsepositives:
- Legitimate business use of hyperlinks embedded in email, chat messages, or documents
opening in Edge
- Automated link-preview or safe-link rewriting features in enterprise email security
products
level: low
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-products-could-allow-for-remote-code-execution_2025-076
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs