Summary

Microsoft’s February 2025 Patch Tuesday addresses multiple security vulnerabilities, including four zero-days, with two actively exploited in the wild. This update covers a total of 67 security flaws, with three classified as critical Remote Code Execution (RCE) vulnerabilities.  

Microsoft  issued a revision for an older zero-day that threatens the latest Windows desktop and server versions.

OEM	Microsoft
Severity	Critical
Date of Announcement	2025-01-14
No. of Vulnerabilities Patched	67
Actively Exploited	Yes
Exploited in Wild	Yes
Advisory Version	1.0

Overview 

The affected products include Windows, Microsoft Office, Microsoft Surface, and various network services. Organizations are strongly advised to apply these patches immediately to mitigate security risks and potential cyberattacks. 

• 63 Microsoft CVEs addressed 

• 4 non-Microsoft CVEs included 

The highlighted vulnerabilities include 4 zero-day flaws, 2 of which are currently being actively exploited. 

Vulnerability Name	CVE ID	Product Affected	Severity	CVSS Score
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	CVE-2025-21418	Windows	High	7.8
Windows Storage Elevation of Privilege Vulnerability	CVE-2025-21391	Windows	High	7.1
Microsoft Surface Security Feature Bypass Vulnerability	CVE-2025-21194	Windows	High	7.1
NTLM Hash Disclosure Spoofing Vulnerability	CVE-2025-21377	Windows	Medium	6.5

Technical Summary 

CVE ID	System Affected	Vulnerability Details	Impact
CVE-2025-21418	Windows server and Windows 10 & 11	Windows ancillary function driver for winsock elevation of privilege vulnerability enables attackers to escalate privileges to SYSTEM level. Specific exploitation details are not disclosed.	Unauthorized access with SYSTEM privileges.
CVE-2025-21391	Windows server and Windows 10 & 11	Windows storage elevation of privilege vulnerability allows attackers to delete targeted files on a system, potentially leading to service unavailability. Does not expose confidential data.	Deletion of critical data, leading to service disruption.
CVE-2025-21194	Microsoft Surface	Microsoft surface security feature bypass vulnerability allows attackers to bypass UEFI protections, compromising the secure kernel. Likely related to “PixieFail” vulnerabilities affecting the IPv6 network stack in Tianocore’s EDK II firmware.	Bypass of security features, potentially compromising system integrity.
CVE-2025-21377	Windows server and Windows 10 & 11	NTLM hash disclosure spoofing vulnerability exposes NTLM hashes when a user interacts with a malicious file. Simply selecting or right-clicking a file could trigger a remote connection, allowing an attacker to capture NTLM hashes for cracking or pass-the-hash attacks.	Potential for attackers to authenticate as the user, leading to unauthorized access.

Source:  Microsoft       

In addition to the actively exploited vulnerabilities, several other critical flaws were also addressed: 

• CVE-2025-21376: A Windows Lightweight Directory Access Protocol (LDAP) RCE vulnerability that could allow attackers to execute arbitrary code remotely. 

• CVE-2025-21379: A DHCP Client Service RCE vulnerability that may enable remote attackers to execute code with elevated privileges. 

• CVE-2025-21381: An RCE vulnerability in Microsoft Excel that could be triggered through malicious spreadsheet files. 

Remediation: 

• Apply Updates: Immediately install the February 2025 Patch Tuesday updates to address these vulnerabilities. 

Conclusion: 

The February 2025 Patch Tuesday release addresses critical security vulnerabilities, including actively exploited zero-days. Timely application of these updates is essential to protect systems from potential threats. Organizations should review the affected products and implement the necessary patches and mitigations to maintain security integrity. 

The attack vector is local, meaning the attacker needs local access — physically or remotely, using SSH method without user interaction and if successful in exploiting, can give the attacker system privileges.

References: 

• https://msrc.microsoft.com/update-guide/releasenote/2025-Feb  

• https://cybersecuritynews.com/microsoft-patch-tuesday-february-2025/