Microsoft Rings in 2025 With Record Security Update - Dark Reading

Microsoft January 2025 Patch Tuesday Security Update

Microsoft's January 2025 Patch Tuesday update is significant for several reasons, including the large number of vulnerabilities addressed and the presence of zero-day exploits.

Number and Scope of Vulnerabilities

Microsoft addressed a total of 159 vulnerabilities in this update, which is the largest number of CVEs (Common Vulnerabilities and Exposures) fixed in a single month since at least 2017[5|.
These vulnerabilities affect a broad spectrum of Microsoft products, including Windows, .NET, Visual Studio, Microsoft Excel, Azure services, Hyper-V, SharePoint Server, Remote Desktop Services, and BitLocker25.

Zero-Day Vulnerabilities

Eight of the vulnerabilities patched are zero-days, with three of them being actively exploited:

Hyper-V Vulnerabilities

• CVE-2025-21333: A 7.8-severity Heap-Based Buffer Overflow vulnerability.
• CVE-2025-21334: A 7.8-severity Use After Free vulnerability.
• CVE-2025-21335: A 7.8-severity Use After Free vulnerability.
  These vulnerabilities affect Windows Hyper-V NT Kernel Integration VSP and allow attackers to gain SYSTEM privileges if successfully exploited. They are under active attack, but the researcher who reported them remains anonymous145.

Other Zero-Days

• CVE-2025-21275: A 7.8-severity Windows App Package Installer Elevation of Privilege vulnerability, judged by Microsoft as "less likely" to be exploited1.
• CVE-2025-21308: A 6.5-rated Windows Themes Spoofing Vulnerability affecting systems with NTLM enabled. This requires user interaction to load a malicious file onto the vulnerable system1.
• CVE-2025-21186, CVE-2025-21366, and CVE-2025-21395: These are 7.8-severity Microsoft Access Remote Code Execution vulnerabilities attributed to the Unpatched.ai vulnerability discovery platform. They are considered to be at lower risk of exploit but require social engineering to convince users to download and run malicious files14.

Critical Vulnerabilities

In addition to the zero-days, several critical vulnerabilities were addressed:

Windows Object Linking and Embedding (OLE)

• CVE-2025-21298: A remote code execution vulnerability with a CVSS score of 9.8. This vulnerability can be exploited by sending a specially crafted email that, even if just previewed in Microsoft Outlook, could allow remote code execution on the victim's computer2.

Windows Reliable Multicast Transport Driver (RMCAST)

• CVE-2025-21307: A remote code execution vulnerability affecting the RMCAST networking technology. This can be exploited if an application is actively listening on a port for Pragmatic General Multicast (PGM) protocol, allowing an unauthenticated attacker to send specially crafted packets2.

Other Notable Vulnerabilities

• BitLocker: A vulnerability (CVE-2025-21210) was fixed in BitLocker, Microsoft's full disk encryption suite. This bug could allow hibernation images to be recovered in plain text, potentially exposing sensitive data such as passwords and credentials4.

Impact and Recommendations

The large number of vulnerabilities addressed in this update, especially the zero-days and critical vulnerabilities, underscores the importance of prompt patching. Security experts recommend prioritizing the patches for Hyper-V and other critical systems to mitigate potential attacks45.

This update is part of Microsoft's ongoing effort to prioritize security, following their announcement last year to make security their top priority and the introduction of new Windows security innovations35.