Microsoft January 2025 Patch Tuesday – 159 Vulnerabilities Fixed, Including 10 Critical RCE’s

Microsoft released a security as part of the Junuray Patch Tuesday that addressed 159 vulnerabilities, including 10 classified as critical Remote Code Execution (RCE) vulnerabilities. These fixes are crucial for securing Windows operating systems and related software against potential exploitation.

Key Highlights of December 2024 Patch Tuesday Updates:

1. CVE-2025-21362 & CVE-2025-21354: Both involve vulnerabilities in Microsoft Excel that allow remote code execution if a user opens a specially crafted file. These are critical as they could enable attackers to execute arbitrary code with user privileges.
2. CVE-2025-21311: A critical vulnerability in Windows NTLM V1 that could allow privilege escalation, potentially giving attackers higher access levels on the system.
3. CVE-2025-21309 & CVE-2025-21297: Both relate to vulnerabilities in Windows Remote Desktop Services, enabling remote code execution through maliciously crafted connections or files.
4. CVE-2025-21307: Affects the Reliable Multicast Transport Driver (RMCAST), allowing remote attackers to execute arbitrary code.
5. CVE-2025-21298 & CVE-2025-21296: These involve vulnerabilities in Windows OLE and BranchCache, respectively, which could permit remote code execution via crafted inputs.
6. CVE-2025-21295 & CVE-2025-21294: Both are critical remote code execution vulnerabilities affecting authentication mechanisms (SPNEGO and Digest Authentication), which could compromise system integrity.

Microsoft Patches 3 Zero-Day Vulnerabilities in January 2025 Security Update

Microsoft has released its January 2025 Patch Tuesday updates, addressing numerous security vulnerabilities, including three critical zero-day flaws that were publicly disclosed and actively exploited.

The updates, aimed at improving the security of Windows and related software, fix issues ranging from privilege escalation to remote code execution and spoofing vulnerabilities. Below are the key details about the zero-day vulnerabilities that were patched:

CVE-2025-21275: Windows App Package Installer Elevation of Privilege Vulnerability

A critical elevation of privilege (EoP) vulnerability identified as CVE-2025-21275 has been fixed in the Windows App Package Installer. This flaw allows an attacker to gain SYSTEM-level privileges on a compromised device. Microsoft acknowledged that an attacker who successfully exploits this vulnerability could take complete control of the affected system.

This vulnerability was reported to Microsoft anonymously. While no specific details about ongoing exploitation have been disclosed, flaws like these are often sought after by attackers aiming to escalate access privileges.

CVE-2025-21308: Windows Themes Spoofing Vulnerability

Another concerning zero-day, tracked as CVE-2025-21308, was found in Windows Themes functionality. This spoofing vulnerability could be triggered merely by displaying a specially crafted Theme file in Windows Explorer.

Unlike many other attacks, users do not necessarily need to open or click on the malicious file—simply loading it in Windows Explorer could exploit the flaw.

The exploit works by leveraging the BrandImage and Wallpaper options in Theme files to specify a network file path.

When Windows Explorer processes these files, it automatically sends the logged-in user’s NTLM credentials to the remote host specified in the Theme file. Attackers can use these NTLM hashes to either crack the plain-text password or execute pass-the-hash attacks.

Steps to Mitigate CVE-2025-21308

Microsoft advises users to disable NTLM or enable the security policy “Restrict NTLM: Outgoing NTLM traffic to remote servers” to mitigate the risk of this vulnerability.

The flaw was discovered by Blaz Satler of 0patch at ACROS Security and is a bypass of a previous vulnerability (CVE-2024-38030). Notably, 0patch had already released micropatches for this flaw in October 2024 while awaiting Microsoft’s official fix.

Microsoft Access Vulnerabilities: CVE-2025-21186, CVE-2025-21366, CVE-2025-21395

Three remote code execution (RCE) vulnerabilities in Microsoft Access, tracked as CVE-2025-21186, CVE-2025-21366, and CVE-2025-21395, have been addressed. These flaws could be exploited by attackers to execute malicious code simply by tricking a victim into opening specially crafted Microsoft Access documents.

The vulnerabilities highlight the importance of avoiding untrusted files and having security solutions in place that can detect suspicious activity in office productivity tools.

Microsoft’s January 2025 Patch Tuesday emphasizes the ever-present risk of zero-day vulnerabilities in widely used software. Users are urged to apply updates immediately to protect their devices from potential exploitation.

Beyond installing updates, organizations should consider implementing additional mitigations, such as disabling NTLM for enterprise networks or using policies to restrict the use of vulnerable protocols.

Microsoft January 2025 Patch Tuesday

Microsoft has published a complete list of patched vulnerabilities, which provides detailed information about the exploitation methods, vulnerability descriptions, and other information. 

All users should update their products to the latest version to prevent threat actors from exploiting these vulnerabilities.

The post Microsoft January 2025 Patch Tuesday – 159 Vulnerabilities Fixed, Including 10 Critical RCE’s appeared first on Cyber Security News.