Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

KB5066835: Windows 11 Version 24H2 / Windows Server 2025 / Windows 11 Version 25H2 Security Update (October 2025)

🗓️ 14 Oct 2025 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 5 Views

Security update 5066835 fixes multiple vulnerabilities in libtiff, TPM two point zero, and IGEL OS Secure Boot.

Related
Refs
Code
ReporterTitlePublishedViews
Family
GithubExploit		Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft
13 Mar 202608:38
–githubexploit
GithubExploit		Exploit for CVE-2025-54957
30 Oct 202507:21
–githubexploit
GithubExploit		Exploit for Use of Uninitialized Resource in Microsoft
12 Jan 202605:07
–githubexploit
GithubExploit		Exploit for CVE-2025-47827
20 May 202510:42
–githubexploit
GithubExploit		Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft
13 Aug 202508:16
–githubexploit
GithubExploit		Exploit for Improper Access Control in Microsoft
28 Oct 202509:42
–githubexploit
IBM Security Bulletins		Security Bulletin: This Power System update is being released to address CVE-2025-2884
28 Jun 202502:35
–ibm
IBM Security Bulletins		Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in libTIFF
7 Dec 202322:45
–ibm
ATTACKERKB		CVE-2025-62208
11 Nov 202517:59
–attackerkb
ATTACKERKB		CVE-2025-62209
11 Nov 202517:59
–attackerkb
Rows per page
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.

#
# The descriptive text and package checks in this plugin were
# extracted from the Microsoft Security Updates API. The text
# itself is copyright (C) Microsoft Corporation.
##

include('compat.inc');

if (description)
{
  script_id(270371);
  script_version("1.10");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/06");

  script_cve_id(
    "CVE-2016-9535",
    "CVE-2025-2884",
    "CVE-2025-24052",
    "CVE-2025-24990",
    "CVE-2025-25004",
    "CVE-2025-47827",
    "CVE-2025-47979",
    "CVE-2025-48004",
    "CVE-2025-48813",
    "CVE-2025-49708",
    "CVE-2025-50152",
    "CVE-2025-50174",
    "CVE-2025-50175",
    "CVE-2025-53139",
    "CVE-2025-53150",
    "CVE-2025-53717",
    "CVE-2025-53768",
    "CVE-2025-54957",
    "CVE-2025-55325",
    "CVE-2025-55326",
    "CVE-2025-55328",
    "CVE-2025-55330",
    "CVE-2025-55331",
    "CVE-2025-55332",
    "CVE-2025-55333",
    "CVE-2025-55334",
    "CVE-2025-55335",
    "CVE-2025-55336",
    "CVE-2025-55337",
    "CVE-2025-55338",
    "CVE-2025-55339",
    "CVE-2025-55340",
    "CVE-2025-55676",
    "CVE-2025-55677",
    "CVE-2025-55678",
    "CVE-2025-55679",
    "CVE-2025-55680",
    "CVE-2025-55681",
    "CVE-2025-55682",
    "CVE-2025-55683",
    "CVE-2025-55684",
    "CVE-2025-55685",
    "CVE-2025-55686",
    "CVE-2025-55687",
    "CVE-2025-55688",
    "CVE-2025-55689",
    "CVE-2025-55690",
    "CVE-2025-55691",
    "CVE-2025-55692",
    "CVE-2025-55693",
    "CVE-2025-55694",
    "CVE-2025-55695",
    "CVE-2025-55696",
    "CVE-2025-55697",
    "CVE-2025-55698",
    "CVE-2025-55699",
    "CVE-2025-55700",
    "CVE-2025-55701",
    "CVE-2025-58714",
    "CVE-2025-58715",
    "CVE-2025-58716",
    "CVE-2025-58717",
    "CVE-2025-58718",
    "CVE-2025-58719",
    "CVE-2025-58720",
    "CVE-2025-58722",
    "CVE-2025-58725",
    "CVE-2025-58726",
    "CVE-2025-58727",
    "CVE-2025-58728",
    "CVE-2025-58729",
    "CVE-2025-58730",
    "CVE-2025-58731",
    "CVE-2025-58732",
    "CVE-2025-58733",
    "CVE-2025-58734",
    "CVE-2025-58735",
    "CVE-2025-58736",
    "CVE-2025-58737",
    "CVE-2025-58738",
    "CVE-2025-58739",
    "CVE-2025-59184",
    "CVE-2025-59185",
    "CVE-2025-59186",
    "CVE-2025-59187",
    "CVE-2025-59188",
    "CVE-2025-59189",
    "CVE-2025-59190",
    "CVE-2025-59191",
    "CVE-2025-59192",
    "CVE-2025-59193",
    "CVE-2025-59194",
    "CVE-2025-59195",
    "CVE-2025-59196",
    "CVE-2025-59197",
    "CVE-2025-59198",
    "CVE-2025-59199",
    "CVE-2025-59200",
    "CVE-2025-59201",
    "CVE-2025-59202",
    "CVE-2025-59203",
    "CVE-2025-59204",
    "CVE-2025-59205",
    "CVE-2025-59206",
    "CVE-2025-59207",
    "CVE-2025-59208",
    "CVE-2025-59209",
    "CVE-2025-59210",
    "CVE-2025-59211",
    "CVE-2025-59214",
    "CVE-2025-59230",
    "CVE-2025-59241",
    "CVE-2025-59242",
    "CVE-2025-59244",
    "CVE-2025-59253",
    "CVE-2025-59254",
    "CVE-2025-59255",
    "CVE-2025-59257",
    "CVE-2025-59258",
    "CVE-2025-59259",
    "CVE-2025-59260",
    "CVE-2025-59261",
    "CVE-2025-59275",
    "CVE-2025-59277",
    "CVE-2025-59278",
    "CVE-2025-59280",
    "CVE-2025-59282",
    "CVE-2025-59284",
    "CVE-2025-59294",
    "CVE-2025-59295",
    "CVE-2025-62208",
    "CVE-2025-62209"
  );
  script_xref(name:"MSKB", value:"5066835");
  script_xref(name:"MSFT", value:"MS25-5066835");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/11/04");
  script_xref(name:"IAVA", value:"2025-A-0775-S");
  script_xref(name:"IAVA", value:"2025-A-0776-S");

  script_name(english:"KB5066835: Windows 11 Version 24H2 / Windows Server 2025 / Windows 11 Version 25H2 Security Update (October 2025)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is missing security update 5066835. It is, therefore, affected by multiple vulnerabilities

  - tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in
    debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with
    subsampling. Reported as MSVR 35105, aka Predictor heap-buffer-overflow. (CVE-2016-9535)

  - TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read
    due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision
    1.83 and advisory TCGVRT0009 for TCG standard TPM2.0 (CVE-2025-2884)

  - In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies
    a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified
    SquashFS image. (CVE-2025-47827)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5066835");
  script_set_attribute(attribute:"solution", value:
"Apply Security Update 5066835");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-9535");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-49708");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/11/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows_11_24h2");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include('smb_func.inc');
include('smb_hotfixes.inc');
include('smb_hotfixes_fcheck.inc');
include('smb_reg_query.inc');

get_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');

var bulletin = 'MS25-10';
var kbs = make_list(
  '5066835'
);

if (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit('SMB/Registry/Enumerated');
get_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);

if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);

var share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  smb_check_rollup(os:'10',
                   os_build:26100,
                   rollup_date:'10_2025',
                   bulletin:bulletin,
                   rollup_kb_list:[5066835])
  || 
  smb_check_rollup(os:'10',
                   os_build:26200,
                   rollup_date:'10_2025',
                   bulletin:bulletin,
                   rollup_kb_list:[5066835])
)
{
  replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
06 Feb 2026 00:00Current
8High risk
Vulners AI Score8
CVSS 27.5
CVSS 39.8
CVSS 3.17.8 - 9.9
EPSS0.05793
SSVC
libtiff vulnerabilitytpm vulnerabilityigel os vulnerabilitysecure boot bypasswindows update
5