VERT Threat Alert: January 2025 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s January 2025 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1139 as soon as coverage is completed.

In-The-Wild & Disclosed CVEs

CVE-2025-21333

The first of three Hyper-V vulnerabilities this month is a heap-based buffer overflow that leads to privilege escalation to SYSTEM. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-21334

The second of three Hyper-V vulnerabilities this month is a use-after-free vulnerability that leads to privilege escalation to SYSTEM. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-21335

The final Hyper-V vulnerability this month is another use-after-free vulnerability that leads to privilege escalation to SYSTEM. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2025-21366

A vulnerability in Microsoft Access is resolved by this update. Specifically, Microsoft’s update blocks the following potentially malicious extensions from being sent in an email. Email recipients will get a notification that the attachment cannot be accessed. The included extensions are:

• accdb
• accde
• accdw
• accdt
• accda
• accdr
• accdu

Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2025-21395

A vulnerability in Microsoft Access is resolved by this update. Specifically, Microsoft’s update blocks the following potentially malicious extensions from being sent in an email. Email recipients will get a notification that the attachment cannot be accessed. The included extensions are:

• accdb
• accde
• accdw
• accdt
• accda
• accdr
• accdu

Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2025-21186

A vulnerability in Microsoft Access is resolved by this update. Specifically, Microsoft’s update blocks the following potentially malicious extensions from being sent in an email. Email recipients will get a notification that the attachment cannot be accessed. The included extensions are:

• accdb
• accde
• accdw
• accdt
• accda
• accdr
• accdu

Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2025-21275

An improper authorization vulnerability in the Windows App Package Installer allows a successful attacker to obtain SYSTEM privileges. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2025-21308

A spoofing vulnerability in Windows Themes could expose sensitive information to an attacker. Systems must have NTLM enabled in order to be impacted by this vulnerability, which requires that a user load a malicious file onto their system. Additionally, Microsoft has recommended enabling the Group Policy setting Restrict NTLM: Outgoing NTLM traffic to remote servers to mitigate the risk of this vulnerability leaking NTLM hashes outside your organization. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also colour coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted.

Other Information

At the time of publication, there were no new advisories included with the January Security Guidance.