Overview
Microsoft's January 2025 security update addresses 161 total vulnerabilities including three actively exploited zero-days affecting Windows Hyper-V NT Kernel Integration VSP. The update includes 11 Critical and 149 Important severity fixes, marking the largest monthly patch release since 2017
Whom it may concern
- System Administrators
- Security Operations Teams
- Virtualization Engineers
- Federal Agencies (CISA KEV deadline: Feb 4, 2025)
Key Findings
- Three zero-day vulnerabilities (CVE-2025-21333/34/35) with CVSS 7.8
- Five critical severity fixes including Windows OLE RCE (CVE-2025-21298) with CVSS 9.8
- Five publicly disclosed vulnerabilities requiring immediate attention
- Enhanced BitLocker security addressing information disclosure risk
Risk Analysis
- Probability: High (Active exploitation confirmed)
- Impact: Critical (System privilege escalation)
- Attack Vector: Local access required
- Exploitation Complexity: Low to Medium
Action Items
- Apply patches immediately for Hyper-V environments
- Implement email security controls for Outlook-related vulnerabilities
- Monitor systems for indicators of compromise
- Review virtualization security boundaries
Sources
- [The Hacker News](https://thehackernews.com/2025/01/3-actively-exploited-zero-day-flaws.html)
