Microsoft's security release of 14 January 2025
Patch Tuesday, January 2025, page 2
As of , CISA lists three of the 157 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-21333, Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 101 | CVE-2025-21296BranchCache Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 102 | CVE-2025-21343Windows Web Threat Defense User Service Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 103 | CVE-2025-21173.NET Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 104 | CVE-2025-21331Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 105 | CVE-2025-21405Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 106 | CVE-2025-21346Microsoft Office Security Feature Bypass | None | Not on CISA's list | 7.1 High | 0.01 |
| 107 | CVE-2025-21211Secure Boot Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 108 | CVE-2025-21357Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 109 | CVE-2025-21226Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 110 | CVE-2025-21227Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 111 | CVE-2025-21228Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 112 | CVE-2025-21229Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 113 | CVE-2025-21232Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 114 | CVE-2025-21249Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 115 | CVE-2025-21255Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 116 | CVE-2025-21256Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 117 | CVE-2025-21258Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 118 | CVE-2025-21260Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 119 | CVE-2025-21261Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 120 | CVE-2025-21263Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 121 | CVE-2025-21265Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 122 | CVE-2025-21310Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 123 | CVE-2025-21324Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 124 | CVE-2025-21327Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 125 | CVE-2025-21341Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 126 | CVE-2025-21193Active Directory Federation Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 127 | CVE-2025-21272Windows COM Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 128 | CVE-2025-21288Windows COM Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 129 | CVE-2025-21314Windows SmartScreen Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 130 | CVE-2025-21403On-Premises Data Gateway Information Disclosure | None | Not on CISA's list | 6.4 Medium | 0.01 |
| 131 | CVE-2025-21393Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 6.3 Medium | 0.01 |
| 132 | CVE-2025-21278Windows Remote Desktop Gateway (RD Gateway) Denial of Service | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 133 | CVE-2025-21202Windows Recovery Environment Agent Elevation of Privilege | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 134 | CVE-2025-21336Windows Cryptographic Information Disclosure | None | Not on CISA's list | 5.6 Medium | 0.01 |
| 135 | CVE-2025-21257Windows WLAN AutoConfig Service Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 136 | CVE-2025-21274Windows Event Tracing Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 137 | CVE-2025-21280Windows Virtual Trusted Platform Module Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 138 | CVE-2025-21284Windows Virtual Trusted Platform Module Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 139 | CVE-2025-21316Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 140 | CVE-2025-21317Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 141 | CVE-2025-21318Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 142 | CVE-2025-21319Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 143 | CVE-2025-21320Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 144 | CVE-2025-21321Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 145 | CVE-2025-21323Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 146 | CVE-2025-21374Windows CSC Service Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 147 | CVE-2025-21213Secure Boot Security Feature Bypass | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 148 | CVE-2025-21215Secure Boot Security Feature Bypass | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 149 | CVE-2025-21332MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 150 | CVE-2025-21210Windows BitLocker Information Disclosure | None | Not on CISA's list | 4.2 Medium | 0.01 |
| 151 | CVE-2025-21214Windows BitLocker Information Disclosure | None | Not on CISA's list | 4.2 Medium | 0.01 |
| 152 | CVE-2025-21312Windows Smart Card Reader Information Disclosure | None | Not on CISA's list | 2.4 Low | 0.01 |
| 153 | CVE-2025-21338GDI+ Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 154 | CVE-2025-21360Microsoft AutoUpdate (MAU) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 155 | CVE-2025-21370Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 156 | CVE-2025-21372Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 157 | CVE-2025-21340Windows Virtualization-Based Security (VBS) Security Feature Bypass | None | Not on CISA's list | 5.5 Medium | 0.00 |