⚡ TL;DR | Go Straight to the January 2025 Patch Tuesday Audit Report
Patch Tuesday is once again upon us. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress. The audit report gives you a quick and clear overview of your Windows machines and their patching status. The January 2025 edition of Patch Tuesday brings us 159 new fixes, with 10 rated as critical and 3 exploited. We’ve listed the most important changes below.
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerabilities
The top vulnerability is not just one vulnerability but three. CVE-2025-21335, CVE-2025-21334, CVE-2025-21333 are three elevation of privilege vulnerabilities that have known exploits. If exploited, an attacker gain SYSTEM privileges.
All three vulnerabilities do not have the highest CVSS score, at 7.8, regardless, since an exploit is available, it still puts it at the top of our list.
Microsoft Excel Vulnerabilities
Microsoft Excel received three fixes. Two remote code execution vulnerabilities (CVE-2025-21354, CVE-2025-21362) and one security feature bypass vulnerability (CVE-2025-21364).
All three vulnerabilities are critical and also receive the «more likely» to be exploited label from Microsoft. The vulnerabilities can be exploited even through the preview functionality Microsoft Excel provides.
Specific to the security bypass vulnerability is that an attacker who successfully exploited this vulnerability could bypass Office macro policies used to block untrusted or malicious files.
Windows OLE Remote Code Execution Vulnerability
The last highlight of this month is CVE-2025-21298. This RCE vulnerability probably has the highest CVSS base score this month with a 9.8! Additionally, it is rated as critical and has the «more likely» to be exploited label.
Microsoft Object Linking and Embedding (OLE) allows embedding and linking objects across applications like Word and Excel, but its flexibility makes it a target for attackers.
Microsoft provided the following additional context:
How could an attacker exploit the vulnerability?
In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted email to the victim. Exploitation of the vulnerability might involve either a victim opening a specially crafted email with an affected version of Microsoft Outlook software, or a victim’s Outlook application displaying a preview of a specially crafted email . This could result in the attacker executing remote code on the victim’s machine.
Run the Patch Tuesday January 2025 Audit
To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.
The Lansweeper Patch Tuesday report is automatically added to your Lansweeper Site. Lansweeper Sites is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one report, automatically added every patch Tuesday!
Patch Tuesday January 2025 CVE Codes & Titles
| CVE Number | CVE Title |
| CVE-2025-21417 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21413 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21411 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21409 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21405 | Visual Studio Elevation of Privilege Vulnerability |
| CVE-2025-21403 | On-Premises Data Gateway Information Disclosure Vulnerability |
| CVE-2025-21402 | Microsoft Office OneNote Remote Code Execution Vulnerability |
| CVE-2025-21395 | Microsoft Access Remote Code Execution Vulnerability |
| CVE-2025-21393 | Microsoft SharePoint Server Spoofing Vulnerability |
| CVE-2025-21389 | Windows upnphost.dll Denial of Service Vulnerability |
| CVE-2025-21382 | Windows Graphics Component Elevation of Privilege Vulnerability |
| CVE-2025-21378 | Windows CSC Service Elevation of Privilege Vulnerability |
| CVE-2025-21374 | Windows CSC Service Information Disclosure Vulnerability |
| CVE-2025-21372 | Microsoft Brokering File System Elevation of Privilege Vulnerability |
| CVE-2025-21370 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
| CVE-2025-21366 | Microsoft Access Remote Code Execution Vulnerability |
| CVE-2025-21365 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2025-21364 | Microsoft Excel Security Feature Bypass Vulnerability |
| CVE-2025-21363 | Microsoft Word Remote Code Execution Vulnerability |
| CVE-2025-21362 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2025-21361 | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2025-21360 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
| CVE-2025-21357 | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2025-21356 | Microsoft Office Visio Remote Code Execution Vulnerability |
| CVE-2025-21354 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2025-21348 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2025-21346 | Microsoft Office Security Feature Bypass Vulnerability |
| CVE-2025-21345 | Microsoft Office Visio Remote Code Execution Vulnerability |
| CVE-2025-21344 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2025-21343 | Windows Web Threat Defense User Service Information Disclosure Vulnerability |
| CVE-2025-21341 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21340 | Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability |
| CVE-2025-21339 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21338 | GDI+ Remote Code Execution Vulnerability |
| CVE-2025-21336 | Windows Cryptographic Information Disclosure Vulnerability |
| CVE-2025-21335 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
| CVE-2025-21334 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
| CVE-2025-21333 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
| CVE-2025-21332 | MapUrlToZone Security Feature Bypass Vulnerability |
| CVE-2025-21331 | Windows Installer Elevation of Privilege Vulnerability |
| CVE-2025-21330 | Windows Remote Desktop Services Denial of Service Vulnerability |
| CVE-2025-21329 | MapUrlToZone Security Feature Bypass Vulnerability |
| CVE-2025-21328 | MapUrlToZone Security Feature Bypass Vulnerability |
| CVE-2025-21327 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21326 | Internet Explorer Remote Code Execution Vulnerability |
| CVE-2025-21324 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21323 | Windows Kernel Memory Information Disclosure Vulnerability |
| CVE-2025-21321 | Windows Kernel Memory Information Disclosure Vulnerability |
| CVE-2025-21320 | Windows Kernel Memory Information Disclosure Vulnerability |
| CVE-2025-21319 | Windows Kernel Memory Information Disclosure Vulnerability |
| CVE-2025-21318 | Windows Kernel Memory Information Disclosure Vulnerability |
| CVE-2025-21317 | Windows Kernel Memory Information Disclosure Vulnerability |
| CVE-2025-21316 | Windows Kernel Memory Information Disclosure Vulnerability |
| CVE-2025-21315 | Microsoft Brokering File System Elevation of Privilege Vulnerability |
| CVE-2025-21314 | Windows SmartScreen Spoofing Vulnerability |
| CVE-2025-21313 | Windows Security Account Manager (SAM) Denial of Service Vulnerability |
| CVE-2025-21312 | Windows Smart Card Reader Information Disclosure Vulnerability |
| CVE-2025-21311 | Windows NTLM V1 Elevation of Privilege Vulnerability |
| CVE-2025-21310 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21309 | Windows Remote Desktop Services Remote Code Execution Vulnerability |
| CVE-2025-21308 | Windows Themes Spoofing Vulnerability |
| CVE-2025-21307 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability |
| CVE-2025-21306 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21305 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21304 | Microsoft DWM Core Library Elevation of Privilege Vulnerability |
| CVE-2025-21303 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21302 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21301 | Windows Geolocation Service Information Disclosure Vulnerability |
| CVE-2025-21300 | Windows upnphost.dll Denial of Service Vulnerability |
| CVE-2025-21299 | Windows Kerberos Security Feature Bypass Vulnerability |
| CVE-2025-21298 | Windows OLE Remote Code Execution Vulnerability |
| CVE-2025-21297 | Windows Remote Desktop Services Remote Code Execution Vulnerability |
| CVE-2025-21296 | BranchCache Remote Code Execution Vulnerability |
| CVE-2025-21295 | SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability |
| CVE-2025-21294 | Microsoft Digest Authentication Remote Code Execution Vulnerability |
| CVE-2025-21293 | Active Directory Domain Services Elevation of Privilege Vulnerability |
| CVE-2025-21292 | Windows Search Service Elevation of Privilege Vulnerability |
| CVE-2025-21291 | Windows Direct Show Remote Code Execution Vulnerability |
| CVE-2025-21290 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2025-21289 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2025-21288 | Windows COM Server Information Disclosure Vulnerability |
| CVE-2025-21287 | Windows Installer Elevation of Privilege Vulnerability |
| CVE-2025-21286 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21285 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2025-21284 | Windows Virtual Trusted Platform Module Denial of Service Vulnerability |
| CVE-2025-21282 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21281 | Microsoft COM for Windows Elevation of Privilege Vulnerability |
| CVE-2025-21280 | Windows Virtual Trusted Platform Module Denial of Service Vulnerability |
| CVE-2025-21278 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability |
| CVE-2025-21277 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2025-21276 | Windows MapUrlToZone Denial of Service Vulnerability |
| CVE-2025-21275 | Windows App Package Installer Elevation of Privilege Vulnerability |
| CVE-2025-21274 | Windows Event Tracing Denial of Service Vulnerability |
| CVE-2025-21273 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21272 | Windows COM Server Information Disclosure Vulnerability |
| CVE-2025-21271 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
| CVE-2025-21270 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2025-21269 | Windows HTML Platforms Security Feature Bypass Vulnerability |
| CVE-2025-21268 | MapUrlToZone Security Feature Bypass Vulnerability |
| CVE-2025-21266 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21265 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21263 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21261 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21260 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21258 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21257 | Windows WLAN AutoConfig Service Information Disclosure Vulnerability |
| CVE-2025-21256 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21255 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21252 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21251 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2025-21250 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21249 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21248 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21246 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21245 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21244 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21243 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21242 | Windows Kerberos Information Disclosure Vulnerability |
| CVE-2025-21241 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21240 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21239 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21238 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21237 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21236 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21235 | Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability |
| CVE-2025-21234 | Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability |
| CVE-2025-21233 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21232 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21231 | IP Helper Denial of Service Vulnerability |
| CVE-2025-21230 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2025-21229 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21228 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21227 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21226 | Windows Digital Media Elevation of Privilege Vulnerability |
| CVE-2025-21225 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability |
| CVE-2025-21224 | Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability |
| CVE-2025-21223 | Windows Telephony Service Remote Code Execution Vulnerability |
| CVE-2025-21220 | Microsoft Message Queuing Information Disclosure Vulnerability |
| CVE-2025-21219 | MapUrlToZone Security Feature Bypass Vulnerability |
| CVE-2025-21218 | Windows Kerberos Denial of Service Vulnerability |
| CVE-2025-21217 | Windows NTLM Spoofing Vulnerability |
| CVE-2025-21215 | Secure Boot Security Feature Bypass Vulnerability |
| CVE-2025-21214 | Windows BitLocker Information Disclosure Vulnerability |
| CVE-2025-21213 | Secure Boot Security Feature Bypass Vulnerability |
| CVE-2025-21211 | Secure Boot Security Feature Bypass Vulnerability |
| CVE-2025-21210 | Windows BitLocker Information Disclosure Vulnerability |
| CVE-2025-21207 | Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability |
| CVE-2025-21202 | Windows Recovery Environment Agent Elevation of Privilege Vulnerability |
| CVE-2025-21193 | Active Directory Federation Server Spoofing Vulnerability |
| CVE-2025-21189 | MapUrlToZone Security Feature Bypass Vulnerability |
| CVE-2025-21187 | Microsoft Power Automate Remote Code Execution Vulnerability |
| CVE-2025-21186 | Microsoft Access Remote Code Execution Vulnerability |
| CVE-2025-21178 | Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-21176 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-21173 | .NET Elevation of Privilege Vulnerability |
| CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-21171 | .NET Remote Code Execution Vulnerability |
| CVE-2024-7344 | Cert CC: CVE-2024-7344 Howyar Taiwan Secure Boot Bypass |
| CVE-2024-50338 | GitHub: CVE-2024-50338 Malformed URL allows information disclosure through git-credential-manager |