Microsoft's security release of 14 January 2025
Patch Tuesday, January 2025
As of , CISA lists three of the 157 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-21333, Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2025-21333Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege. Listed by CISA on 14 January 2025, release day
- CVE-2025-21334Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege. Listed by CISA on 14 January 2025, release day
- CVE-2025-21335Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege. Listed by CISA on 14 January 2025, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 157 CVEs |
| On CISA's list of exploited vulnerabilities | 3 CVEs |
| CISA's SSVC exploitation: active | 3 CVEs |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 153 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 3 CVEs |
| EPSS 0.10 or more | 6 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-21333Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.10 |
| 2 | CVE-2025-21334Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.02 |
| 3 | CVE-2025-21335Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.01 |
| 4 | CVE-2025-21298Windows OLE Remote Code Execution | Proof of concept | Not on CISA's list | 9.8 Critical | 0.81 |
| 5 | CVE-2025-21285Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.56 |
| 6 | CVE-2025-21277Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.39 |
| 7 | CVE-2025-21293Active Directory Domain Services Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.19 |
| 8 | CVE-2025-21309Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.15 |
| 9 | CVE-2025-21269Windows HTML Platforms Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.05 |
| 10 | CVE-2025-21218Windows Kerberos Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 11 | CVE-2025-21230Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 12 | CVE-2025-21231IP Helper Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 13 | CVE-2025-21251Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 14 | CVE-2025-21300Windows Universal Plug and Play (UPnP) Device Host Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 15 | CVE-2025-21189MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.03 |
| 16 | CVE-2025-21219MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.03 |
| 17 | CVE-2025-21307Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 18 | CVE-2025-21311Windows NTLM V1 Elevation of Privilege | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 19 | CVE-2025-21176.NET, .NET Framework, and Visual Studio Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 20 | CVE-2025-21178Visual Studio Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 21 | CVE-2025-21223Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 22 | CVE-2025-21233Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 23 | CVE-2025-21236Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 24 | CVE-2025-21237Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 25 | CVE-2025-21238Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 26 | CVE-2025-21240Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 27 | CVE-2025-21243Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 28 | CVE-2025-21244Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 29 | CVE-2025-21245Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 30 | CVE-2025-21246Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 31 | CVE-2025-21250Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 32 | CVE-2025-21224Windows Line Printer Daemon (LPD) Service Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.02 |
| 33 | CVE-2025-21295SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.02 |
| 34 | CVE-2025-21364Microsoft Excel Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.02 |
| 35 | CVE-2025-21171.NET Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.02 |
| 36 | CVE-2025-21172.NET and Visual Studio Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.02 |
| 37 | CVE-2025-21207Windows Connected Devices Platform Service (Cdpsvc) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 38 | CVE-2025-21220Microsoft Message Queuing Information Disclosure | None | Not on CISA's list | 7.5 High | 0.02 |
| 39 | CVE-2025-21270Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 40 | CVE-2025-21276Windows MapUrlToZone Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 41 | CVE-2025-21289Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 42 | CVE-2025-21290Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 43 | CVE-2025-21330Windows Remote Desktop Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 44 | CVE-2025-21389Windows Universal Plug and Play (UPnP) Device Host Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 45 | CVE-2025-21348Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.02 |
| 46 | CVE-2025-21299Windows Kerberos Security Feature Bypass | None | Not on CISA's list | 7.1 High | 0.02 |
| 47 | CVE-2025-21217Windows NTLM Spoofing | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 48 | CVE-2025-21301Windows Geolocation Service Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 49 | CVE-2025-21308Windows Themes Spoofing | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 50 | CVE-2025-21313Windows Security Account Manager (SAM) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 51 | CVE-2025-21225Windows Remote Desktop Gateway (RD Gateway) Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.02 |
| 52 | CVE-2025-21242Windows Kerberos Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.02 |
| 53 | CVE-2025-21268MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.02 |
| 54 | CVE-2025-21328MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.02 |
| 55 | CVE-2025-21329MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.02 |
| 56 | CVE-2025-21239Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 57 | CVE-2025-21241Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 58 | CVE-2025-21248Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 59 | CVE-2025-21252Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 60 | CVE-2025-21266Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 61 | CVE-2025-21273Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 62 | CVE-2025-21282Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 63 | CVE-2025-21286Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 64 | CVE-2025-21291Windows Direct Show Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 65 | CVE-2025-21292Windows Search Service Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 66 | CVE-2025-21302Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 67 | CVE-2025-21303Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 68 | CVE-2025-21305Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 69 | CVE-2025-21306Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 70 | CVE-2025-21339Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 71 | CVE-2025-21409Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 72 | CVE-2025-21411Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 73 | CVE-2025-21413Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 74 | CVE-2025-21417Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 75 | CVE-2025-21354Microsoft Excel Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 76 | CVE-2025-21362Microsoft Excel Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 77 | CVE-2025-21294Microsoft Digest Authentication Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 78 | CVE-2025-21297Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 79 | CVE-2025-21186Microsoft Access Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 80 | CVE-2025-21187Microsoft Power Automate Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 81 | CVE-2025-21234Windows PrintWorkflowUserSvc Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 82 | CVE-2025-21235Windows PrintWorkflowUserSvc Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 83 | CVE-2025-21271Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 84 | CVE-2025-21275Windows App Package Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 85 | CVE-2025-21281Microsoft COM for Windows Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 86 | CVE-2025-21287Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 87 | CVE-2025-21304Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 88 | CVE-2025-21315Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 89 | CVE-2025-21326Internet Explorer Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 90 | CVE-2025-21344Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 91 | CVE-2025-21345Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 92 | CVE-2025-21356Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 93 | CVE-2025-21361Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 94 | CVE-2025-21363Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 95 | CVE-2025-21365Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 96 | CVE-2025-21366Microsoft Access Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 97 | CVE-2025-21378Windows CSC Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 98 | CVE-2025-21382Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 99 | CVE-2025-21395Microsoft Access Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 100 | CVE-2025-21402Microsoft Office OneNote Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 14 January 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.