Vulnerabilitycritical
Microsoft Patch Tuesday for January 2025 — Snort rules and prominent vulnerabilities
- CVEs
- CVE-2025-21309CVE-2025-21298CVE-2025-21294CVE-2025-21295CVE-2025-21296CVE-2025-21297CVE-2025-21307CVE-2025-21311CVE-2025-21362CVE-2025-21380CVE-2025-21385CVE-2025-21189CVE-2025-21210CVE-2025-21219CVE-2025-21268CVE-2025-21269CVE-2025-21292CVE-2025-21299CVE-2025-21314CVE-2025-21315CVE-2025-21328CVE-2025-21329CVE-2025-21354CVE-2025-21364CVE-2025-21365
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-21298 | Use-After-Free RCE in Windows OLE (CVE-2025-21298) | 9.8 group max | 74% | PoC | |
| CVE-2025-21292 | Windows Search Service Elevation of Privilege Vulnerability | 8.8 | <1% | ||
CVE-2025-21309+1 related CVE | Windows Remote Desktop Services Remote Code Execution Vulnerability | 8.1 | 15% | ||
CVE-2025-21311+1 related CVE | Windows NTLM V1 Elevation of Privilege Vulnerability | 9.8 group max | 2% | ||
| CVE-2025-21314 | Windows SmartScreen Spoofing Vulnerability | 6.5 | 1% | ||
CVE-2025-21362+3 related CVEs | Microsoft Excel Remote Code Execution Vulnerability | 8.4 group max | <1% | ||
| CVE-2025-21380 | Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network | 6.5 | 2% | ||
| CVE-2025-21385 | Authenticated SSRF in Microsoft Purview Enables Information Disclosure | 6.5 | 24% |
From the original article
4 min read at blog.talosintelligence.com
Microsoft has released its monthly security update for January of 2025 which includes 159 vulnerabilities, including 12 that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.” One notable critically rated vulnerability that has been patched this month is CVE-2025-21309 , which is a remote code execution vulnerability affecting Windows Remote Desktop Services.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.