Report Name: Microsoft Patch Tuesday, January 2025
Generated: 2025-01-15 01:32:44

Product Name	Prevalence	U	C	H	M	L	A	Comment
Active Directory Federation Server	0.9				1		1	Active Directory is a directory service developed by Microsoft for Windows domain networks
Microsoft Message Queuing	0.9				1		1	Microsoft Message Queuing or MSMQ is a message queue implementation developed by Microsoft and deployed in its Windows Server operating systems since Windows NT 4 and Windows 95
Windows NTLM	0.9				1		1	A suite of security protocols to authenticate users' identity and protect the integrity and confidentiality of their activity
Chromium	0.8			3	4		7	Chromium is a free and open-source web browser project, mainly developed and maintained by Google
GDI+	0.8			1			1	GDI+
Microsoft COM	0.8				1		1	COM is a platform-independent, distributed, object-oriented system for creating binary software components that can interact
Microsoft DWM Core Library	0.8				1		1	Windows component
Microsoft Office	0.8			1	1		2	Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer
Secure Boot	0.8				4		4	Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM)
Windows App Package Installer	0.8				1		1	Windows component
Windows BitLocker	0.8				2		2	Windows component
Windows COM Server	0.8				2		2	Windows component
Windows CSC Service	0.8				2		2	Windows component
Windows Cloud Files Mini Filter Driver	0.8				1		1	Windows component
Windows Connected Devices Platform Service (Cdpsvc)	0.8				1		1	Windows component
Windows Cryptographic	0.8				1		1	Windows component
Windows Digital Media	0.8				17		17	Windows component
Windows Direct Show	0.8			1			1	Windows component
Windows Event Tracing	0.8				1		1	Windows component
Windows Geolocation Service	0.8				1		1	Windows component
Windows Graphics Component	0.8				1		1	Windows component
Windows HTML Platforms	0.8				1		1	Windows component
Windows Hyper-V NT Kernel Integration VSP	0.8			3			3	Windows component
Windows Installer	0.8			1	1		2	Windows component
Windows Kerberos	0.8				3		3	Windows component
Windows Kernel Memory	0.8				7		7	Windows component
Windows Line Printer Daemon (LPD) Service	0.8			1			1	Windows component
Windows MapUrlToZone	0.8				1		1	Windows component
Windows NTLM V1	0.8			1			1	Windows component
Windows OLE	0.8			1			1	Windows component
Windows PrintWorkflowUserSvc	0.8				2		2	Windows component
Windows Recovery Environment Agent	0.8				1		1	Windows component
Windows Reliable Multicast Transport Driver (RMCAST)	0.8			1			1	Windows component
Windows Remote Desktop Gateway (RD Gateway)	0.8				2		2	Windows component
Windows Remote Desktop Services	0.8			2			2	Remote Desktop Services, known as Terminal Services in Windows Server 2008 and earlier, is one of the components of Microsoft Windows that allow a user to initiate and control an interactive session on a remote computer or virtual machine over a network connection
Windows Remote Desktop Services Denial of Service Vulnerability	0.8				1		1	Windows component
Windows Search Service	0.8				1		1	Windows component
Windows Security Account Manager (SAM)	0.8				1		1	Windows component
Windows Smart Card Reader	0.8				1		1	Windows component
Windows SmartScreen	0.8				1		1	SmartScreen is a cloud-based anti-phishing and anti-malware component included in several Microsoft products, including operating systems Windows 8 and later, the applications Internet Explorer, Microsoft Edge
Windows Telephony Service	0.8			28			28	Windows component
Windows Themes	0.8				1		1	Windows component
Windows Virtual Trusted Platform Module	0.8				2		2	Windows component
Windows Virtualization-Based Security (VBS)	0.8				1		1	Windows component
Windows Virtualization-Based Security (VBS) Enclave	0.8				1		1	Windows component
Windows WLAN AutoConfig Service	0.8				1		1	Windows сomponent
Windows Web Threat Defense User Service	0.8				1		1	Windows component
Windows upnphost.dll	0.8				2		2	Windows component
.NET	0.7				3		3	.NET
.NET and Visual Studio	0.7				1		1	.NET and Visual Studio
Internet Explorer	0.6				1		1	Internet Explorer is a discontinued series of graphical web browsers developed by Microsoft
Microsoft Access	0.6				3		3	MS Office product
Microsoft Excel	0.6				3		3	MS Office product
Microsoft Office Visio	0.6				2		2	Microsoft Visio
Microsoft Outlook	0.6				2		2	Microsoft Outlook is a personal information manager software system from Microsoft, available as a part of the Microsoft 365 software suites
Microsoft Word	0.6				1		1	Microsoft Word is a widely used commercial word processor developed by Microsoft. It is a component of the Microsoft Office suite of productivity software but can also be purchased as a standalone product.
.NET, .NET Framework, and Visual Studio	0.5				1		1	.NET, .NET Framework, and Visual Studio
Active Directory Domain Services	0.5				1		1	Active Directory Domain Services
BranchCache	0.5				1		1	BranchCache
Defender for Endpoint	0.5				1		1	Product detected by a:microsoft:defender_for_endpoint (exists in CPE dict)
IP Helper	0.5				1		1	IP Helper
MapUrlToZone	0.5				6		6	MapUrlToZone
Microsoft AutoUpdate (MAU)	0.5				1		1	Microsoft AutoUpdate (MAU)
Microsoft Brokering File System	0.5				2		2	Microsoft Brokering File System
Microsoft Digest Authentication	0.5				1		1	Microsoft Digest Authentication
Microsoft Message Queuing (MSMQ)	0.5				7		7	Microsoft Message Queuing (MSMQ)
Microsoft Office OneNote	0.5				1		1	Microsoft Office OneNote
Microsoft Power Automate	0.5				1		1	Microsoft Power Automate
Microsoft SharePoint Server	0.5				3		3	Microsoft SharePoint Server
On-Premises Data Gateway	0.5				1		1	On-Premises Data Gateway
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism	0.5				1		1	SPNEGO Extended Negotiation (NEGOEX) Security Mechanism
update_catalog	0.5			1			1	Product detected by a:microsoft:update_catalog (does NOT exist in CPE dict)
Azure	0.4			1			1	Azure
Microsoft Purview	0.3				1		1	Microsoft Purview is a comprehensive set of solutions that can help your organization govern, protect, and manage data, wherever it lives
Visual Studio	0.3				2		2	Integrated development environment

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0			39	22		61
Authentication Bypass	0.98			1			1
Command Injection	0.97				1		1
Security Feature Bypass	0.9			1	15		16
Elevation of Privilege	0.85			5	35		40
Information Disclosure	0.83				22		22
Denial of Service	0.7				20		20
Memory Corruption	0.5				4		4
Spoofing	0.4				5		5

Source	U	C	H	M	L	A
MS PT Extended			4	6		10
Qualys			9	22		31
Tenable			6	5		11
Rapid7			5	5		10
ZDI			6	2		8

Urgent (0)

Critical (0)

High (46)

1. Elevation of Privilege - Windows Hyper-V NT Kernel Integration VSP (CVE-2025-21333) - High [594]

Description: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Qualys: CVE-2025-21333, CVE-2025-21334, & CVE-2025-21335: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability Windows Hyper-V NT Kernel Integration VSP refers to the Virtualization Service Provider component within the Hyper-V virtualization platform on Windows. The tool acts as a bridge between the Hyper-V hypervisor and the Windows NT kernel, allowing seamless communication and management of virtual machines running on the host system. Successful exploitation of the vulnerability could allow an attacker to SYTEM privileges.

Tenable: Microsoft’s January 2025 Patch Tuesday Addresses 157 CVEs (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)

Tenable: CVE-2025-21333, CVE-2025-21334, CVE-2025-21335 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerabilities

Tenable: CVE-2025-21333, CVE-2025-21334 and CVE-2025-21335 are EoP vulnerabilities in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). All three vulnerabilities were assigned a CVSSv3 score of 7.8 and rated important. An authenticated, local attacker could exploit this vulnerability to elevate privileges to SYSTEM. Two of the three vulnerabilities were unattributed, with CVE-2025-21333 being attributed to an Anonymous researcher.

Rapid7: Microsoft is addressing a trio of related Windows Hyper-V NT Kernel Integration VSP elevation of privilege vulnerabilities today: CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335. Microsoft is aware of exploitation in the wild for all three, as seen on both the Microsoft advisories and CISA KEV. In each case, exploitation leads to SYSTEM privileges. The advisories are short on additional detail, beyond a brief acknowledgement of Anonymous — presumably an undisclosed party, rather than the hacktivist collective — on CVE-2025-21333.

ZDI: CVE-2025-21333/CVE-2025-21334/CVE-2025-21335 - Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability. These three bugs are listed as under active attack, and all have the same description. An authenticated user could use these to execute code with SYSTEM privileges. Although not specified, I would think that if the attacker were executing code at SYSTEM on the hypervisor from a guest, the CVSS would indicate a scope change. Microsoft doesn’t list that, but I’ve disagreed with their CVSS ratings in the past. If you are running Hyper-V, make sure these patches are at the top of your list for testing and deployment.

2. Elevation of Privilege - Windows Hyper-V NT Kernel Integration VSP (CVE-2025-21334) - High [594]

Description: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Qualys: CVE-2025-21333, CVE-2025-21334, & CVE-2025-21335: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability Windows Hyper-V NT Kernel Integration VSP refers to the Virtualization Service Provider component within the Hyper-V virtualization platform on Windows. The tool acts as a bridge between the Hyper-V hypervisor and the Windows NT kernel, allowing seamless communication and management of virtual machines running on the host system. Successful exploitation of the vulnerability could allow an attacker to SYTEM privileges.

Tenable: Microsoft’s January 2025 Patch Tuesday Addresses 157 CVEs (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)

Tenable: CVE-2025-21333, CVE-2025-21334, CVE-2025-21335 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerabilities

Tenable: CVE-2025-21333, CVE-2025-21334 and CVE-2025-21335 are EoP vulnerabilities in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). All three vulnerabilities were assigned a CVSSv3 score of 7.8 and rated important. An authenticated, local attacker could exploit this vulnerability to elevate privileges to SYSTEM. Two of the three vulnerabilities were unattributed, with CVE-2025-21333 being attributed to an Anonymous researcher.

Rapid7: Microsoft is addressing a trio of related Windows Hyper-V NT Kernel Integration VSP elevation of privilege vulnerabilities today: CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335. Microsoft is aware of exploitation in the wild for all three, as seen on both the Microsoft advisories and CISA KEV. In each case, exploitation leads to SYSTEM privileges. The advisories are short on additional detail, beyond a brief acknowledgement of Anonymous — presumably an undisclosed party, rather than the hacktivist collective — on CVE-2025-21333.

ZDI: CVE-2025-21333/CVE-2025-21334/CVE-2025-21335 - Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability. These three bugs are listed as under active attack, and all have the same description. An authenticated user could use these to execute code with SYSTEM privileges. Although not specified, I would think that if the attacker were executing code at SYSTEM on the hypervisor from a guest, the CVSS would indicate a scope change. Microsoft doesn’t list that, but I’ve disagreed with their CVSS ratings in the past. If you are running Hyper-V, make sure these patches are at the top of your list for testing and deployment.

3. Elevation of Privilege - Windows Hyper-V NT Kernel Integration VSP (CVE-2025-21335) - High [594]

Description: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Qualys: CVE-2025-21333, CVE-2025-21334, & CVE-2025-21335: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability Windows Hyper-V NT Kernel Integration VSP refers to the Virtualization Service Provider component within the Hyper-V virtualization platform on Windows. The tool acts as a bridge between the Hyper-V hypervisor and the Windows NT kernel, allowing seamless communication and management of virtual machines running on the host system. Successful exploitation of the vulnerability could allow an attacker to SYTEM privileges.

Tenable: Microsoft’s January 2025 Patch Tuesday Addresses 157 CVEs (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)

Tenable: CVE-2025-21333, CVE-2025-21334, CVE-2025-21335 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerabilities

Tenable: CVE-2025-21333, CVE-2025-21334 and CVE-2025-21335 are EoP vulnerabilities in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). All three vulnerabilities were assigned a CVSSv3 score of 7.8 and rated important. An authenticated, local attacker could exploit this vulnerability to elevate privileges to SYSTEM. Two of the three vulnerabilities were unattributed, with CVE-2025-21333 being attributed to an Anonymous researcher.

Rapid7: Microsoft is addressing a trio of related Windows Hyper-V NT Kernel Integration VSP elevation of privilege vulnerabilities today: CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335. Microsoft is aware of exploitation in the wild for all three, as seen on both the Microsoft advisories and CISA KEV. In each case, exploitation leads to SYSTEM privileges. The advisories are short on additional detail, beyond a brief acknowledgement of Anonymous — presumably an undisclosed party, rather than the hacktivist collective — on CVE-2025-21333.

ZDI: CVE-2025-21333/CVE-2025-21334/CVE-2025-21335 - Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability. These three bugs are listed as under active attack, and all have the same description. An authenticated user could use these to execute code with SYSTEM privileges. Although not specified, I would think that if the attacker were executing code at SYSTEM on the hypervisor from a guest, the CVSS would indicate a scope change. Microsoft doesn’t list that, but I’ve disagreed with their CVSS ratings in the past. If you are running Hyper-V, make sure these patches are at the top of your list for testing and deployment.

4. Security Feature Bypass - update_catalog (CVE-2024-49147) - High [503]

Description: Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.

MS PT Extended: CVE-2024-49147 was published before January 2025 Patch Tuesday from 2024-12-11 to 2025-01-13

5. Elevation of Privilege - Windows Installer (CVE-2025-21287) - High [501]

Description: Windows Installer Elevation of Privilege Vulnerability

6. Authentication Bypass - Azure (CVE-2025-21380) - High [453]

Description: Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.

MS PT Extended: CVE-2025-21380 was published before January 2025 Patch Tuesday from 2024-12-11 to 2025-01-13

7. Remote Code Execution - Chromium (CVE-2024-12695) - High [430]

Description: Chromium: CVE-2024-12695 Out of bounds write in V8. This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

MS PT Extended: CVE-2024-12695 was published before January 2025 Patch Tuesday from 2024-12-11 to 2025-01-13

8. Remote Code Execution - Windows OLE (CVE-2025-21298) - High [430]

Description: Windows OLE Remote Code Execution Vulnerability

Qualys: CVE-2025-21298: Windows OLE Remote Code Execution Vulnerability Object Linking and Embedding (OLE) is a Microsoft Windows standard that allows users to create and edit documents that contain objects from multiple applications. An attacker may exploit the vulnerability in an email attack scenario by sending a specially crafted email to the victim. The victim must open a specially crafted email with an affected Microsoft Outlook software version for successful exploitation. Upon successful exploitation, an attacker can achieve remote code execution on the victim’s machine.

Tenable: CVE-2025-21298 | Windows OLE Remote Code Execution Vulnerability

Tenable: CVE-2025-21298 is a RCE vulnerability in Microsoft Windows Object Linking and Embedding (OLE). It was assigned a CVSSv3 score of 9.8 and is rated critical. It has been assessed as “Exploitation More Likely.” An attacker could exploit this vulnerability by sending a specially crafted email to a target. Successful exploitation would lead to remote code execution on the target system if the target opens this email using a vulnerable version of Microsoft Outlook or if their software is able to preview the email through a preview pane.

Rapid7: Outlook admins who force their users to read emails in plain text only can skip this paragraph, but everyone else should be aware of CVE-2025-21298, a Windows Object Linking and Embedding (OLE) critical RCE with a CVSSv3 base score of 9.8. The eternal threat of the malicious inbound email finds expression again here; just previewing the wrong email in Outlook is all it takes for an attacker to achieve code execution in the context of the user. All versions of Windows receive a patch.

ZDI: CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability. This bug rates a CVSS 9.8 and allows a remote attacker to execute code on a target system by sending a specially crafted mail to an affected system with Outlook. Fortunately, the preview pane is not an attack vector, but previewing an attachment could trigger the code execution. The specific flaw exists within the parsing of RTF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. As a mitigation, you can set Outlook to read all standard mail as plain text, but users will likely revolt against such a setting. The best option is to test and deploy this patch quickly.

9. Remote Code Execution - Windows Reliable Multicast Transport Driver (RMCAST) (CVE-2025-21307) - High [430]

Description: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Qualys: CVE-2025-21307: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability The Windows Reliable Multicast Transport Driver (RMCAST) is a component within the Windows operating system that enables reliable multicast data transmission. An unauthenticated attacker could exploit the vulnerability by sending specially crafted packets to a Windows Pragmatic General Multicast (PGM) open socket on the server without any interaction from the user.

Rapid7: Microsoft’s in-house research teams are a reliable source of vulnerability discovery in Microsoft products, and today we get patches for the self-discovered CVE-2025-21307, a critical RCE in the Windows Reliable Multicast Transport Driver (RMCAST) with a CVSSv3 base score of 9.8. The vulnerability is only exploitable on a system where a program is listening on a Pragmatic General Multicast (PGM) port.

Rapid7: Given the lack of required user interaction and remote attack vector for CVE-2025-21307, it’s well worth asking yourself: does our firewall allow a PGM receiver to receive inbound traffic from the public internet? If so, the second-best time to prevent that is right now.

10. Remote Code Execution - Chromium (CVE-2024-12693) - High [419]

Description: Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

MS PT Extended: CVE-2024-12693 was published before January 2025 Patch Tuesday from 2024-12-11 to 2025-01-13

11. Remote Code Execution - Chromium (CVE-2025-0291) - High [419]

Description: Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

12. Remote Code Execution - Windows Direct Show (CVE-2025-21291) - High [419]

Description: Windows Direct Show Remote Code Execution Vulnerability

13. Remote Code Execution - Windows Telephony Service (CVE-2025-21223) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

14. Remote Code Execution - Windows Telephony Service (CVE-2025-21233) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

15. Remote Code Execution - Windows Telephony Service (CVE-2025-21236) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

16. Remote Code Execution - Windows Telephony Service (CVE-2025-21237) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

17. Remote Code Execution - Windows Telephony Service (CVE-2025-21238) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

18. Remote Code Execution - Windows Telephony Service (CVE-2025-21239) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

19. Remote Code Execution - Windows Telephony Service (CVE-2025-21240) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

20. Remote Code Execution - Windows Telephony Service (CVE-2025-21241) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

21. Remote Code Execution - Windows Telephony Service (CVE-2025-21243) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

22. Remote Code Execution - Windows Telephony Service (CVE-2025-21244) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

23. Remote Code Execution - Windows Telephony Service (CVE-2025-21245) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

24. Remote Code Execution - Windows Telephony Service (CVE-2025-21246) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

25. Remote Code Execution - Windows Telephony Service (CVE-2025-21248) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

26. Remote Code Execution - Windows Telephony Service (CVE-2025-21250) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

27. Remote Code Execution - Windows Telephony Service (CVE-2025-21252) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

28. Remote Code Execution - Windows Telephony Service (CVE-2025-21266) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

29. Remote Code Execution - Windows Telephony Service (CVE-2025-21273) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

30. Remote Code Execution - Windows Telephony Service (CVE-2025-21282) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

31. Remote Code Execution - Windows Telephony Service (CVE-2025-21286) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

32. Remote Code Execution - Windows Telephony Service (CVE-2025-21302) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

33. Remote Code Execution - Windows Telephony Service (CVE-2025-21303) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

34. Remote Code Execution - Windows Telephony Service (CVE-2025-21305) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

35. Remote Code Execution - Windows Telephony Service (CVE-2025-21306) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

36. Remote Code Execution - Windows Telephony Service (CVE-2025-21339) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

37. Remote Code Execution - Windows Telephony Service (CVE-2025-21409) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

38. Remote Code Execution - Windows Telephony Service (CVE-2025-21411) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

39. Remote Code Execution - Windows Telephony Service (CVE-2025-21413) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

40. Remote Code Execution - Windows Telephony Service (CVE-2025-21417) - High [419]

Description: Windows Telephony Service Remote Code Execution Vulnerability

41. Remote Code Execution - GDI+ (CVE-2025-21338) - High [407]

Description: GDI+ Remote Code Execution Vulnerability

42. Remote Code Execution - Microsoft Office (CVE-2025-21365) - High [407]

Description: Microsoft Office Remote Code Execution Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-21210 is an information disclosure vulnerability in Windows BitLocker. Successful exploitation of the vulnerability could allow an attacker to disclose unencrypted hibernation images in cleartext. CVE-2025-21268, CVE-2025-21219, CVE-2025-21189, CVE-2025-21328, & CVE-2025-21329 are security feature bypass vulnerabilities in MapUrlToZone. Upon successful exploitation, an attacker could bypass the MapURLToZone method to view some sensitive information. CVE-2025-21269 is a security feature bypass vulnerability in Windows HTML Platforms. Successful exploitation of the vulnerability could allow an attacker to view some sensitive information. CVE-2025-21292 is an elevation of privilege vulnerability in Windows Search Service. Successful exploitation of the vulnerability could allow an attacker to gain SYSTEM privileges. CVE-2025-21299 is a security feature bypass vulnerability in Windows Kerberos. Successful exploitation of the vulnerability could allow an attacker to bypass Windows Defender Credential Guard Feature to leak Kerberos Credential. CVE-2025-21314 is a spoofing vulnerability in Windows SmartScreen. To successfully exploit the vulnerability, an attacker must send the victim a malicious file that the victim would have to execute. CVE-2025-21315 is an elevation of privilege vulnerability in the Microsoft Brokering File System. Upon successful exploitation, an attacker could potentially gain the ability to crash the system by exploiting the use-after-free vulnerability. CVE-2025-21364 is a security feature bypass vulnerability in Microsoft Excel. Successful exploitation of the vulnerability may allow an attacker to bypass Office macro policies used to block untrusted or malicious files. CVE-2025-21365 is a remote code execution vulnerability in Microsoft Office. Successful exploitation of the vulnerability may allow an attacker to achieve remote code execution.

43. Remote Code Execution - Windows Line Printer Daemon (LPD) Service (CVE-2025-21224) - High [407]

Description: Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability

44. Remote Code Execution - Windows Remote Desktop Services (CVE-2025-21297) - High [407]

Description: Windows Remote Desktop Services Remote Code Execution Vulnerability

Qualys: CVE-2025-21297 & CVE-2025-21309: Windows Remote Desktop Services Remote Code Execution Vulnerability Windows Remote Desktop Services (RDS) is a Microsoft feature that allows users to access and control a remote computer’s desktop and applications over a network connection. An attacker must win a race condition to exploit the vulnerabilities. An attacker could exploit these vulnerabilities by connecting to a system with the Remote Desktop Gateway role. Then, it would trigger the race condition to create a use-after-free scenario, ultimately leading to arbitrary code execution.

Tenable: CVE-2025-21297, CVE-2025-21309 | Windows Remote Desktop Services Remote Code Execution Vulnerability

Tenable: CVE-2025-21297 and CVE-2025-21309 are critical RCE vulnerabilities affecting Windows Remote Desktop Services. Both of these vulnerabilities were assigned CVSSv3 scores of 8.1, however CVE-2025-21309 was assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index, while CVE-2025-21297 was assessed as “Exploitation Less Likely.”

ZDI: CVE-2025-21297/CVE-2025-21309 - Windows Remote Desktop Services Remote Code Execution Vulnerability. Both of these bugs allow arbitrary code execution on affected Remote Desktop Gateway servers from remote, unauthenticated attackers. They just need to connect to the server and trigger a race condition to create a use-after-free bug. While race conditions are somewhat tricky to exploit, we see them used at Pwn2Own frequently. Considering that exploiting this requires no user interaction, I would prioritize this patch, especially if you have these gateways exposed to the Internet.

45. Remote Code Execution - Windows Remote Desktop Services (CVE-2025-21309) - High [407]

Description: Windows Remote Desktop Services Remote Code Execution Vulnerability

Qualys: CVE-2025-21297 & CVE-2025-21309: Windows Remote Desktop Services Remote Code Execution Vulnerability Windows Remote Desktop Services (RDS) is a Microsoft feature that allows users to access and control a remote computer’s desktop and applications over a network connection. An attacker must win a race condition to exploit the vulnerabilities. An attacker could exploit these vulnerabilities by connecting to a system with the Remote Desktop Gateway role. Then, it would trigger the race condition to create a use-after-free scenario, ultimately leading to arbitrary code execution.

Tenable: CVE-2025-21297, CVE-2025-21309 | Windows Remote Desktop Services Remote Code Execution Vulnerability

Tenable: CVE-2025-21297 and CVE-2025-21309 are critical RCE vulnerabilities affecting Windows Remote Desktop Services. Both of these vulnerabilities were assigned CVSSv3 scores of 8.1, however CVE-2025-21309 was assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index, while CVE-2025-21297 was assessed as “Exploitation Less Likely.”

ZDI: CVE-2025-21297/CVE-2025-21309 - Windows Remote Desktop Services Remote Code Execution Vulnerability. Both of these bugs allow arbitrary code execution on affected Remote Desktop Gateway servers from remote, unauthenticated attackers. They just need to connect to the server and trigger a race condition to create a use-after-free bug. While race conditions are somewhat tricky to exploit, we see them used at Pwn2Own frequently. Considering that exploiting this requires no user interaction, I would prioritize this patch, especially if you have these gateways exposed to the Internet.

46. Elevation of Privilege - Windows NTLM V1 (CVE-2025-21311) - High [404]

Description: Windows NTLM V1 Elevation of Privilege Vulnerability

Qualys: CVE-2025-21311: Windows NTLM V1 Elevation of Privilege Vulnerability Windows NTLM V1 (NT LAN Manager Version 1) is a Microsoft authentication protocol used for network logins on Windows systems. Successful exploration of the vulnerability could allow an attacker to escalate privileges.

Medium (124)

47. Information Disclosure - Microsoft Message Queuing (CVE-2025-21220) - Medium [393]

Description: Microsoft Message Queuing Information Disclosure Vulnerability

48. Elevation of Privilege - Windows Search Service (CVE-2025-21292) - Medium [392]

Description: Windows Search Service Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-21210 is an information disclosure vulnerability in Windows BitLocker. Successful exploitation of the vulnerability could allow an attacker to disclose unencrypted hibernation images in cleartext. CVE-2025-21268, CVE-2025-21219, CVE-2025-21189, CVE-2025-21328, & CVE-2025-21329 are security feature bypass vulnerabilities in MapUrlToZone. Upon successful exploitation, an attacker could bypass the MapURLToZone method to view some sensitive information. CVE-2025-21269 is a security feature bypass vulnerability in Windows HTML Platforms. Successful exploitation of the vulnerability could allow an attacker to view some sensitive information. CVE-2025-21292 is an elevation of privilege vulnerability in Windows Search Service. Successful exploitation of the vulnerability could allow an attacker to gain SYSTEM privileges. CVE-2025-21299 is a security feature bypass vulnerability in Windows Kerberos. Successful exploitation of the vulnerability could allow an attacker to bypass Windows Defender Credential Guard Feature to leak Kerberos Credential. CVE-2025-21314 is a spoofing vulnerability in Windows SmartScreen. To successfully exploit the vulnerability, an attacker must send the victim a malicious file that the victim would have to execute. CVE-2025-21315 is an elevation of privilege vulnerability in the Microsoft Brokering File System. Upon successful exploitation, an attacker could potentially gain the ability to crash the system by exploiting the use-after-free vulnerability. CVE-2025-21364 is a security feature bypass vulnerability in Microsoft Excel. Successful exploitation of the vulnerability may allow an attacker to bypass Office macro policies used to block untrusted or malicious files. CVE-2025-21365 is a remote code execution vulnerability in Microsoft Office. Successful exploitation of the vulnerability may allow an attacker to achieve remote code execution.

49. Remote Code Execution - .NET (CVE-2025-21171) - Medium [390]

Description: .NET Remote Code Execution Vulnerability

50. Remote Code Execution - .NET and Visual Studio (CVE-2025-21172) - Medium [390]

Description: .NET and Visual Studio Remote Code Execution Vulnerability

51. Elevation of Privilege - Microsoft COM (CVE-2025-21281) - Medium [380]

Description: Microsoft COM for Windows Elevation of Privilege Vulnerability

52. Elevation of Privilege - Microsoft DWM Core Library (CVE-2025-21304) - Medium [380]

Description: Microsoft DWM Core Library Elevation of Privilege Vulnerability

53. Elevation of Privilege - Windows App Package Installer (CVE-2025-21275) - Medium [380]

Description: Windows App Package Installer Elevation of Privilege Vulnerability

Qualys: CVE-2025-21275: Windows App Package Installer Elevation of Privilege Vulnerability A Windows App Package Installer, often called App Installer, is a built-in component of the Windows operating system that allows users to install applications easily. An attacker could gain SYSTEM privileges upon successful exploitation of the vulnerability.

Tenable: CVE-2025-21275 | Windows App Package Installer Elevation of Privilege Vulnerability

Tenable: CVE-2025-21275 is an EoP vulnerability in the Microsoft Windows App Package Installer. It was assigned a CVSSv3 score of 7.8 and is rated important. A local, authenticated attacker could exploit this vulnerability to obtain SYSTEM privileges. These types of flaws are often associated with post-compromise activity, after an attacker has breached a system through other means.

Rapid7: Installing or updating software often requires elevated privileges, and researchers and threat actors have known this for a long time. The advisory for CVE-2025-21275 doesn’t weigh us down with lengthy explanations, it simply says that successful exploitation leads to SYSTEM privileges. Microsoft is aware of public disclosure of this vulnerability, but not in-the-wild exploitation.

Rapid7: CVE-2025-21275 is the latest in a long line of Windows Installer elevation of privilege vulnerabilities; Microsoft has now published 37 Windows Installer elevation of privilege vulnerabilities in total since the start of 2020, although only five of those have been zero-days, with only CVE-2024-38014 known by Microsoft to have been exploited prior to publication in September 2024.

54. Elevation of Privilege - Windows CSC Service (CVE-2025-21378) - Medium [380]

Description: Windows CSC Service Elevation of Privilege Vulnerability

55. Elevation of Privilege - Windows Cloud Files Mini Filter Driver (CVE-2025-21271) - Medium [380]

Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

56. Elevation of Privilege - Windows Graphics Component (CVE-2025-21382) - Medium [380]

Description: Windows Graphics Component Elevation of Privilege Vulnerability

57. Elevation of Privilege - Windows PrintWorkflowUserSvc (CVE-2025-21234) - Medium [380]

Description: Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability

58. Elevation of Privilege - Windows PrintWorkflowUserSvc (CVE-2025-21235) - Medium [380]

Description: Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability

59. Elevation of Privilege - Windows Virtualization-Based Security (VBS) Enclave (CVE-2025-21370) - Medium [380]

Description: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

60. Security Feature Bypass - Microsoft Office (CVE-2025-21346) - Medium [377]

Description: Microsoft Office Security Feature Bypass Vulnerability

61. Security Feature Bypass - Secure Boot (CVE-2024-7344) - Medium [377]

Description: {'ms_cve_data_all': 'Cert CC: CVE-2024-7344 Howyar Taiwan Secure Boot Bypass. This CVE was assigned by CERT CC. The purpose of this document is to attest to the fact that the products listed in the Security Updates table have been updated to protect against this vulnerability.\n', 'nvd_cve_data_all': 'Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}

62. Security Feature Bypass - Secure Boot (CVE-2025-21211) - Medium [377]

Description: Secure Boot Security Feature Bypass Vulnerability

63. Security Feature Bypass - Windows Kerberos (CVE-2025-21299) - Medium [377]

Description: Windows Kerberos Security Feature Bypass Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-21210 is an information disclosure vulnerability in Windows BitLocker. Successful exploitation of the vulnerability could allow an attacker to disclose unencrypted hibernation images in cleartext. CVE-2025-21268, CVE-2025-21219, CVE-2025-21189, CVE-2025-21328, & CVE-2025-21329 are security feature bypass vulnerabilities in MapUrlToZone. Upon successful exploitation, an attacker could bypass the MapURLToZone method to view some sensitive information. CVE-2025-21269 is a security feature bypass vulnerability in Windows HTML Platforms. Successful exploitation of the vulnerability could allow an attacker to view some sensitive information. CVE-2025-21292 is an elevation of privilege vulnerability in Windows Search Service. Successful exploitation of the vulnerability could allow an attacker to gain SYSTEM privileges. CVE-2025-21299 is a security feature bypass vulnerability in Windows Kerberos. Successful exploitation of the vulnerability could allow an attacker to bypass Windows Defender Credential Guard Feature to leak Kerberos Credential. CVE-2025-21314 is a spoofing vulnerability in Windows SmartScreen. To successfully exploit the vulnerability, an attacker must send the victim a malicious file that the victim would have to execute. CVE-2025-21315 is an elevation of privilege vulnerability in the Microsoft Brokering File System. Upon successful exploitation, an attacker could potentially gain the ability to crash the system by exploiting the use-after-free vulnerability. CVE-2025-21364 is a security feature bypass vulnerability in Microsoft Excel. Successful exploitation of the vulnerability may allow an attacker to bypass Office macro policies used to block untrusted or malicious files. CVE-2025-21365 is a remote code execution vulnerability in Microsoft Office. Successful exploitation of the vulnerability may allow an attacker to achieve remote code execution.

64. Information Disclosure - Windows Web Threat Defense User Service (CVE-2025-21343) - Medium [376]

Description: Windows Web Threat Defense User Service Information Disclosure Vulnerability

65. Remote Code Execution - Internet Explorer (CVE-2025-21326) - Medium [373]

Description: Internet Explorer Remote Code Execution Vulnerability

66. Remote Code Execution - Microsoft Access (CVE-2025-21186) - Medium [373]

Description: Microsoft Access Remote Code Execution Vulnerability

Qualys: CVE-2025-21366, CVE-2025-21395, & CVE-2025-21186: Microsoft Access Remote Code Execution Vulnerability Microsoft Access is a database management system (DBMS) that helps users store, organize, and analyze data. Microsoft Access stores data in its format, or it can import or link to data from other applications. Microsoft addressed the vulnerabilities by blocking access to the following extensions: accdb accde accdw accdt accda accdr accdu

Tenable: CVE-2025-21186, CVE-2025-21366, CVE-2025-21395 | Microsoft Access Remote Code Execution Vulnerability

Tenable: CVE-2025-21186, CVE-2025-21366 and CVE-2025-21395 are RCE vulnerabilities in Microsoft Access, a database management system. All three vulnerabilities were assigned a CVSSv3 score of 7.8 and rated important. A remote, unauthenticated attacker could exploit this vulnerability by convincing a target through social engineering to download and open a malicious file. Successful exploitation would grant an attacker arbitrary code execution privileges on the vulnerable system. This update “blocks potentially malicious extensions from being sent in an email.”

Rapid7: Today sees the publication of three very similar zero-day Microsoft Access vulnerabilities: CVE-2025-21366, CVE-2025-21395, and CVE-2025-21186. In each case, Microsoft notes public disclosure, but does not claim evidence of exploitation in the wild. Successful exploitation leads to code execution via heap-based buffer overflow, and requires that an attacker convince the user to download and open a malicious file.

67. Remote Code Execution - Microsoft Access (CVE-2025-21366) - Medium [373]

Description: Microsoft Access Remote Code Execution Vulnerability

Qualys: CVE-2025-21366, CVE-2025-21395, & CVE-2025-21186: Microsoft Access Remote Code Execution Vulnerability Microsoft Access is a database management system (DBMS) that helps users store, organize, and analyze data. Microsoft Access stores data in its format, or it can import or link to data from other applications. Microsoft addressed the vulnerabilities by blocking access to the following extensions: accdb accde accdw accdt accda accdr accdu

Tenable: CVE-2025-21186, CVE-2025-21366, CVE-2025-21395 | Microsoft Access Remote Code Execution Vulnerability

Tenable: CVE-2025-21186, CVE-2025-21366 and CVE-2025-21395 are RCE vulnerabilities in Microsoft Access, a database management system. All three vulnerabilities were assigned a CVSSv3 score of 7.8 and rated important. A remote, unauthenticated attacker could exploit this vulnerability by convincing a target through social engineering to download and open a malicious file. Successful exploitation would grant an attacker arbitrary code execution privileges on the vulnerable system. This update “blocks potentially malicious extensions from being sent in an email.”

Rapid7: Today sees the publication of three very similar zero-day Microsoft Access vulnerabilities: CVE-2025-21366, CVE-2025-21395, and CVE-2025-21186. In each case, Microsoft notes public disclosure, but does not claim evidence of exploitation in the wild. Successful exploitation leads to code execution via heap-based buffer overflow, and requires that an attacker convince the user to download and open a malicious file.

68. Remote Code Execution - Microsoft Access (CVE-2025-21395) - Medium [373]

Description: Microsoft Access Remote Code Execution Vulnerability

Qualys: CVE-2025-21366, CVE-2025-21395, & CVE-2025-21186: Microsoft Access Remote Code Execution Vulnerability Microsoft Access is a database management system (DBMS) that helps users store, organize, and analyze data. Microsoft Access stores data in its format, or it can import or link to data from other applications. Microsoft addressed the vulnerabilities by blocking access to the following extensions: accdb accde accdw accdt accda accdr accdu

Tenable: CVE-2025-21186, CVE-2025-21366, CVE-2025-21395 | Microsoft Access Remote Code Execution Vulnerability

Tenable: CVE-2025-21186, CVE-2025-21366 and CVE-2025-21395 are RCE vulnerabilities in Microsoft Access, a database management system. All three vulnerabilities were assigned a CVSSv3 score of 7.8 and rated important. A remote, unauthenticated attacker could exploit this vulnerability by convincing a target through social engineering to download and open a malicious file. Successful exploitation would grant an attacker arbitrary code execution privileges on the vulnerable system. This update “blocks potentially malicious extensions from being sent in an email.”

Rapid7: Today sees the publication of three very similar zero-day Microsoft Access vulnerabilities: CVE-2025-21366, CVE-2025-21395, and CVE-2025-21186. In each case, Microsoft notes public disclosure, but does not claim evidence of exploitation in the wild. Successful exploitation leads to code execution via heap-based buffer overflow, and requires that an attacker convince the user to download and open a malicious file.

69. Remote Code Execution - Microsoft Excel (CVE-2025-21354) - Medium [373]

Description: Microsoft Excel Remote Code Execution Vulnerability

Qualys: CVE-2025-21354 & CVE-2025-21362: Microsoft Excel Remote Code Execution Vulnerability Microsoft Excel is a spreadsheet program that helps users organize and analyze data. It’s available on Windows, macOS, Android, iOS, and iPadOS. Successful exploitation of the vulnerability could allow an attacker to achieve remote code execution of vulnerable targets.

70. Remote Code Execution - Microsoft Excel (CVE-2025-21362) - Medium [373]

Description: Microsoft Excel Remote Code Execution Vulnerability

Qualys: CVE-2025-21354 & CVE-2025-21362: Microsoft Excel Remote Code Execution Vulnerability Microsoft Excel is a spreadsheet program that helps users organize and analyze data. It’s available on Windows, macOS, Android, iOS, and iPadOS. Successful exploitation of the vulnerability could allow an attacker to achieve remote code execution of vulnerable targets.

71. Remote Code Execution - Microsoft Office Visio (CVE-2025-21345) - Medium [373]

Description: Microsoft Office Visio Remote Code Execution Vulnerability

72. Remote Code Execution - Microsoft Office Visio (CVE-2025-21356) - Medium [373]

Description: Microsoft Office Visio Remote Code Execution Vulnerability

73. Remote Code Execution - Microsoft Outlook (CVE-2025-21361) - Medium [373]

Description: Microsoft Outlook Remote Code Execution Vulnerability

74. Remote Code Execution - Microsoft Word (CVE-2025-21363) - Medium [373]

Description: Microsoft Word Remote Code Execution Vulnerability

75. Security Feature Bypass - MapUrlToZone (CVE-2025-21189) - Medium [372]

Description: MapUrlToZone Security Feature Bypass Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-21210 is an information disclosure vulnerability in Windows BitLocker. Successful exploitation of the vulnerability could allow an attacker to disclose unencrypted hibernation images in cleartext. CVE-2025-21268, CVE-2025-21219, CVE-2025-21189, CVE-2025-21328, & CVE-2025-21329 are security feature bypass vulnerabilities in MapUrlToZone. Upon successful exploitation, an attacker could bypass the MapURLToZone method to view some sensitive information. CVE-2025-21269 is a security feature bypass vulnerability in Windows HTML Platforms. Successful exploitation of the vulnerability could allow an attacker to view some sensitive information. CVE-2025-21292 is an elevation of privilege vulnerability in Windows Search Service. Successful exploitation of the vulnerability could allow an attacker to gain SYSTEM privileges. CVE-2025-21299 is a security feature bypass vulnerability in Windows Kerberos. Successful exploitation of the vulnerability could allow an attacker to bypass Windows Defender Credential Guard Feature to leak Kerberos Credential. CVE-2025-21314 is a spoofing vulnerability in Windows SmartScreen. To successfully exploit the vulnerability, an attacker must send the victim a malicious file that the victim would have to execute. CVE-2025-21315 is an elevation of privilege vulnerability in the Microsoft Brokering File System. Upon successful exploitation, an attacker could potentially gain the ability to crash the system by exploiting the use-after-free vulnerability. CVE-2025-21364 is a security feature bypass vulnerability in Microsoft Excel. Successful exploitation of the vulnerability may allow an attacker to bypass Office macro policies used to block untrusted or malicious files. CVE-2025-21365 is a remote code execution vulnerability in Microsoft Office. Successful exploitation of the vulnerability may allow an attacker to achieve remote code execution.

76. Security Feature Bypass - MapUrlToZone (CVE-2025-21268) - Medium [372]

Description: MapUrlToZone Security Feature Bypass Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-21210 is an information disclosure vulnerability in Windows BitLocker. Successful exploitation of the vulnerability could allow an attacker to disclose unencrypted hibernation images in cleartext. CVE-2025-21268, CVE-2025-21219, CVE-2025-21189, CVE-2025-21328, & CVE-2025-21329 are security feature bypass vulnerabilities in MapUrlToZone. Upon successful exploitation, an attacker could bypass the MapURLToZone method to view some sensitive information. CVE-2025-21269 is a security feature bypass vulnerability in Windows HTML Platforms. Successful exploitation of the vulnerability could allow an attacker to view some sensitive information. CVE-2025-21292 is an elevation of privilege vulnerability in Windows Search Service. Successful exploitation of the vulnerability could allow an attacker to gain SYSTEM privileges. CVE-2025-21299 is a security feature bypass vulnerability in Windows Kerberos. Successful exploitation of the vulnerability could allow an attacker to bypass Windows Defender Credential Guard Feature to leak Kerberos Credential. CVE-2025-21314 is a spoofing vulnerability in Windows SmartScreen. To successfully exploit the vulnerability, an attacker must send the victim a malicious file that the victim would have to execute. CVE-2025-21315 is an elevation of privilege vulnerability in the Microsoft Brokering File System. Upon successful exploitation, an attacker could potentially gain the ability to crash the system by exploiting the use-after-free vulnerability. CVE-2025-21364 is a security feature bypass vulnerability in Microsoft Excel. Successful exploitation of the vulnerability may allow an attacker to bypass Office macro policies used to block untrusted or malicious files. CVE-2025-21365 is a remote code execution vulnerability in Microsoft Office. Successful exploitation of the vulnerability may allow an attacker to achieve remote code execution.

77. Remote Code Execution - .NET, .NET Framework, and Visual Studio (CVE-2025-21176) - Medium [369]

Description: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

78. Elevation of Privilege - Windows Digital Media (CVE-2025-21226) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

79. Elevation of Privilege - Windows Digital Media (CVE-2025-21227) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

80. Elevation of Privilege - Windows Digital Media (CVE-2025-21228) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

81. Elevation of Privilege - Windows Digital Media (CVE-2025-21229) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

82. Elevation of Privilege - Windows Digital Media (CVE-2025-21232) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

83. Elevation of Privilege - Windows Digital Media (CVE-2025-21249) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

84. Elevation of Privilege - Windows Digital Media (CVE-2025-21255) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

85. Elevation of Privilege - Windows Digital Media (CVE-2025-21256) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

86. Elevation of Privilege - Windows Digital Media (CVE-2025-21258) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

87. Elevation of Privilege - Windows Digital Media (CVE-2025-21260) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

88. Elevation of Privilege - Windows Digital Media (CVE-2025-21261) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

89. Elevation of Privilege - Windows Digital Media (CVE-2025-21263) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

90. Elevation of Privilege - Windows Digital Media (CVE-2025-21265) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

91. Elevation of Privilege - Windows Digital Media (CVE-2025-21310) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

92. Elevation of Privilege - Windows Digital Media (CVE-2025-21324) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

93. Elevation of Privilege - Windows Digital Media (CVE-2025-21327) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

94. Elevation of Privilege - Windows Digital Media (CVE-2025-21341) - Medium [368]

Description: Windows Digital Media Elevation of Privilege Vulnerability

95. Elevation of Privilege - Windows Installer (CVE-2025-21331) - Medium [368]

Description: Windows Installer Elevation of Privilege Vulnerability

96. Memory Corruption - Chromium (CVE-2024-12381) - Medium [365]

Description: Chromium: CVE-2024-12381 Type Confusion in V8. This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

MS PT Extended: CVE-2024-12381 was published before January 2025 Patch Tuesday from 2024-12-11 to 2025-01-13

97. Memory Corruption - Chromium (CVE-2024-12382) - Medium [365]

Description: Chromium: CVE-2024-12382 Use after free in Translate. This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

MS PT Extended: CVE-2024-12382 was published before January 2025 Patch Tuesday from 2024-12-11 to 2025-01-13

98. Security Feature Bypass - Windows Virtualization-Based Security (VBS) (CVE-2025-21340) - Medium [365]

Description: Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

99. Information Disclosure - Windows COM Server (CVE-2025-21272) - Medium [364]

Description: Windows COM Server Information Disclosure Vulnerability

100. Information Disclosure - Windows COM Server (CVE-2025-21288) - Medium [364]

Description: Windows COM Server Information Disclosure Vulnerability