Microsoft Patch Tuesday January 2025: Fixes 159 vulnerabilities

Yesterday, Microsoft released the January 2025 Patch Tuesday, which fixes 159 vulnerabilities. Eight of them are zero-days, with three being actively exploited in attacks.

Additionally, twelve of the fixed vulnerabilities have been rated “Critical,” as they allow information disclosure, privilege escalation, and remote code execution.

The categories of bugs fixed with Microsoft Patch Tuesday January 2025 are the following:

• 58 vulnerabilities that allow remote code execution
• 40 vulnerabilities that allow privilege escalation
• 24 vulnerabilities that allow information disclosure
• 20 vulnerabilities that allow Denial of Service attacks
• 14 vulnerabilities that allow bypassing security features
• 5 vulnerabilities that allow spoofing

8 zero-days fixed – Three used in attacks

Microsoft Patch Tuesday January 2025 fixes three zero-day vulnerabilities that have been used by hackers in attacks and five that have been published before the update was released.

See also: Google OAuth “Sign in with Google” vulnerability exposes millions of accounts

Generally, Microsoft classifies a flaw as a zero-day when it is publicly disclosed or when it is exploited while no official patch is available.

Exploitation of vulnerabilities

Hackers are exploiting the following three vulnerabilities: CVE-2025-21333, CVE-2025-21334, CVE-2025-21335. They are privilege escalation that affect Windows Hyper-V. The vulnerabilities were exploited to gain SYSTEM privileges on Windows devices.

No information has been published regarding how they are exploited.

Vulnerability disclosure

The zero-day vulnerabilities fixed with Microsoft Patch Tuesday January 2025 and just made publicare:

CVE-2025-21275 – Windows App Package Installer Elevation of Privilege Vulnerability

This is an elevation of privilege vulnerability in Windows App Package Installer, which could lead to SYSTEM privileges.

CVE-2025-21308 – Windows Themes Spoofing Vulnerability

Microsoft has fixed a Windows Theme that could be exploited by displaying a specially crafted Theme file in Windows Explorer.

“An attacker would have to convince a user to upload a malicious file to a vulnerable system, typically via a decoy in an email or message. They would then have to convince the user to manipulate the specially crafted file, but not necessarily to click or open the malicious file,” Microsoft states in its January 2025 Patch Tuesday.

The vulnerability was discovered by Blaz Satler from ACROS Security and is a workaround for a previous flaw identified as CVE-2024-38030.

See also: CISA added BeyondTrust vulnerability to KEV List

CVE-2025-21186, CVE-2025-21366, CVE-2025-21395 – Microsoft Access Remote Code Execution Vulnerabilities

Microsoft Patch Tuesday January 2025 also fixes three zero-day vulnerabilities that could allow remote code execution and affect Microsoft Access. The exploit occurs when opening specially crafted Microsoft Access documents.

Microsoft has mitigated this issue by blocking access to the following Microsoft Access documents sent via email:

accdb
accde
accdw
accdt
accda
accdr
accdu

The three vulnerabilities were identified by Unpatched.ai, an AI-based vulnerability discovery platform

See also: Juniper Networks patches serious vulnerabilities in Junos OS

Microsoft Patch Tuesday January 2025: All the vulnerabilities fixed

Microsoft Patch Tuesday January 2025

Microsoft Patch Tuesday is a practice followed by Microsoft, where on the second Tuesday of each month it releases updates and fixes for its operating systems, programs, and applications. These updates typically include security, performance improvements, and new features.

The purpose of Microsoft Patch Tuesday is to provide Microsoft users with the best possible user experience by fixing issues and ensuring the security of their systems. Security updates help protect systems from security vulnerabilities and malware. These updates fix known security issues and strengthen the resilience of systems against attacks.

Source: www.bleepingcomputer.com