Microsoft Releases January 2025 Security Updates

Scheduled updates for Microsoft products, including security updates for 159 vulnerabilities, with three reported as actively exploited

Threat ID:: CC-4607
Threat Severity:: Medium
Published:: 15 January 2025 4:12 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled updates for Microsoft products, including security updates for 159 vulnerabilities, with three reported as actively exploited

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows Server

Microsoft Office

The following platforms are also known to be affected:

.NET, .NET Framework, Visual Studio
Active Directory Domain Services
Active Directory Federation Services
Internet Explorer
Line Printer Daemon Service (LPD)
Microsoft AutoUpdate (MAU)
Microsoft Azure Gateway Manager
Microsoft Brokering File System
Microsoft Digest Authentication
Microsoft Edge (Chromium-based)
Microsoft Graphics Component
Microsoft Office Access
Microsoft Office Excel
Microsoft Office OneNote
Microsoft Office Outlook
Microsoft Office SharePoint
Microsoft Office Visio
Microsoft Office Word
Power Automate
Reliable Multicast Transport Driver (RMCAST)
Servicing Stack Updates
Windows BitLocker
Windows Client-Side Caching (CSC) Service
Windows COM
Windows Connected Devices Platform Service
Windows Cryptographic Services
Windows Digital Media
Windows Direct Show
Windows DWM Core Library
Windows Event Tracing
Windows Hello
Windows Hyper-V NT Kernel Integration VSP
Windows Installer
Windows Kerberos
Windows Kernel Memory
Windows Message Queuing
Windows NTLM
Windows OLE
Windows PrintWorkflowUserSvc
Windows Recovery Environment Agent
Windows Remote Desktop Services
Windows Secure Boot
Windows Security Account Manager
Windows Smart Card
Windows SmartScreen
Windows SPNEGO Extended Negotiation
Windows Telephony Service
Windows UPnP Device Host
Windows Virtual Trusted Platform Module
Windows Virtualization-Based Security (VBS) Enclave
Windows Web Threat Defense User Service
Windows WLAN Auto Config Service

Threat details

Exploitation of CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335

Microsoft has stated that exploitation of the vulnerabilities CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335 has been observed. NHS England's National CSOC considered further exploitation as highly likely.

Introduction

Microsoft has released security updates to address 159 vulnerabilities in Microsoft products. Six vulnerabilities are outlined below, of which three are critical severity and three others that are actively exploited.

Vulnerability Details

CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability

CVE-2025-21298 is a 'Use After Free' vulnerability in Windows and Windows Server with a CVSSv3 score of 9.8. Successful exploitation would allow a remote, unauthenticated attacker to perform remote code execution (RCE).

CVE-2025-21307 - Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

CVE-2025-21307 is a ‘Use After Free’ vulnerability in Windows and Windows Server with a CVSSv3 score of 9.8. Successful exploitation would allow a remote, unauthenticated attacker to perform RCE.

CVE-2025-21311 - Windows NTLM V1 Elevation of Privilege Vulnerability

CVE-2025-21311 is an ‘Incorrect Implementation of Authentication Algorithm’ vulnerability in Windows and Windows Server with a CVSSv3 score of 9.8. Successful exploitation would allow a remote unauthenticated attacker to escalate privileges.

CVE-2025-21333 - Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

CVE-2025-21333 is a ‘Heap-based Buffer Overflow’ Free’ vulnerability in Windows and Windows Server with a CVSSv3 score of 7.8. Successful exploitation would allow an attacker to gain SYSTEM privileges. This vulnerability is under active exploitation.

CVE-2025-21334 - Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

CVE-2025-21334 is a ‘Use After Free’ vulnerability in Windows and Windows Server with a CVSSv3 score of 7.8. Successful exploitation would allow an attacker to gain SYSTEM privileges. This vulnerability is under active exploitation.

CVE-2025-21335 - Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

CVE-2025-21335 is a ‘Use After Free’ vulnerability in Windows and Windows Server with a CVSSv3 score of 7.8. Successful exploitation would allow an attacker to gain SYSTEM privileges. This vulnerability is under active exploitation.