Microsoft's security release of 11 February 2025
Patch Tuesday, February 2025
As of , CISA lists two of the 55 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-21391, Windows Storage Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2025-21391Windows Storage Elevation of Privilege. Listed by CISA on 11 February 2025, release day
- CVE-2025-21418Windows Ancillary Function Driver for WinSock Elevation of Privilege. Listed by CISA on 11 February 2025, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 55 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 53 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | 2 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-21391Windows Storage Elevation of Privilege | Active | Patch soonListed | 7.1 High | 0.02 |
| 2 | CVE-2025-21418Windows Ancillary Function Driver for WinSock Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.02 |
| 3 | CVE-2025-21377NTLM Hash Disclosure Spoofing | None | Not on CISA's list | 6.5 Medium | 0.40 |
| 4 | CVE-2025-21400Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.34 |
| 5 | CVE-2025-21376Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.09 |
| 6 | CVE-2025-21420Windows Disk Cleanup Tool Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 7 | CVE-2025-21181Microsoft Message Queuing (MSMQ) Denial of Service | None | Not on CISA's list | 7.5 High | 0.04 |
| 8 | CVE-2025-21190Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 9 | CVE-2025-21200Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 10 | CVE-2025-21201Windows Telephony Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 11 | CVE-2025-21208Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 12 | CVE-2025-21368Microsoft Digest Authentication Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 13 | CVE-2025-21369Microsoft Digest Authentication Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 14 | CVE-2025-21371Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 15 | CVE-2025-21406Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 16 | CVE-2025-21407Windows Telephony Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 17 | CVE-2025-21410Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 18 | CVE-2025-21351Windows Active Directory Domain Services API Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 19 | CVE-2025-21350Windows Kerberos Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.02 |
| 20 | CVE-2025-21198Microsoft High Performance Compute (HPC) Pack Remote Code Execution | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 21 | CVE-2025-21322Microsoft PC Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 22 | CVE-2025-21358Windows Core Messaging Elevation of Privileges | None | Not on CISA's list | 7.8 High | 0.01 |
| 23 | CVE-2025-21359Windows Kernel Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.01 |
| 24 | CVE-2025-21367Windows Win32 Kernel Subsystem Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 25 | CVE-2025-21373Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 26 | CVE-2025-21375Kernel Streaming WOW Thunk Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 27 | CVE-2025-21381Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 28 | CVE-2025-21383Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.8 High | 0.01 |
| 29 | CVE-2025-21386Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 30 | CVE-2025-21387Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 31 | CVE-2025-21390Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2025-21392Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2025-21394Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2025-21397Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2025-21182Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.01 |
| 36 | CVE-2025-21183Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.01 |
| 37 | CVE-2025-21206Visual Studio Installer Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 38 | CVE-2025-24039Visual Studio Code Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 39 | CVE-2025-24042Visual Studio Code JS Debug Extension Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 40 | CVE-2025-21194Microsoft Surface Security Feature Bypass | None | Not on CISA's list | 7.1 High | 0.01 |
| 41 | CVE-2025-21379DHCP Client Service Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.01 |
| 42 | CVE-2025-21419Windows Setup Files Cleanup Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 43 | CVE-2025-21184Windows Core Messaging Elevation of Privileges | None | Not on CISA's list | 7.0 High | 0.01 |
| 44 | CVE-2025-21414Windows Core Messaging Elevation of Privileges | None | Not on CISA's list | 7.0 High | 0.01 |
| 45 | CVE-2025-21349Windows Remote Desktop Configuration Service Tampering | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 46 | CVE-2025-21212Internet Connection Sharing (ICS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 47 | CVE-2025-21216Internet Connection Sharing (ICS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 48 | CVE-2025-21254Internet Connection Sharing (ICS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 49 | CVE-2025-21352Internet Connection Sharing (ICS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 50 | CVE-2025-21188Azure Network Watcher VM Extension Elevation of Privilege | None | Not on CISA's list | 6.0 Medium | 0.01 |
| 51 | CVE-2025-21347Windows Deployment Services Denial of Service | None | Not on CISA's list | 6.0 Medium | 0.01 |
| 52 | CVE-2025-21259Microsoft Outlook Spoofing | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 53 | CVE-2025-21179DHCP Client Service Denial of Service | None | Not on CISA's list | 4.8 Medium | 0.01 |
| 54 | CVE-2025-21337Windows NTFS Elevation of Privilege | None | Not on CISA's list | 3.3 Low | 0.01 |
| 55 | CVE-2025-24036Microsoft AutoUpdate (MAU) Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 11 February 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.