CVE-2025-37938 tracing: Verify event formats that have "%*p.."

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft CVEs Address Event Format Vulnerabilities Microsoft has published information on two vulnerabilities: CVE-2025-37938 and CVE-2024-43891. CVE-2025-37938, published on May 20, 2025, involves verification of event formats with '%*p..', while CVE-2024-43891, published on August 26, 2024, pertains to ensuring format files honor EVENT_FILE_FL_FREED. These vulnerabilities may affect systems utilizing these event formats. 3 sources 39