159-CVE January Patch Tuesday smashes single-month record

Microsoft on Tuesday released 159 patches touching 13 product families. Nine of the addressed issues are considered by Microsoft to be of Critical severity, and 43 have a CVSS base score of 8.0 or higher. Three are under active exploit in the wild. One can best be mitigated by “configur[ing] Microsoft Outlook to read all standard mail in plain text.”

The unprecedented patch haul falls mainly to Windows, with 132 patches applicable to the operating system. (132 patches would itself quality as the third-largest release since 2020.) Within that group, a number of themes emerge – 28 remote-code-execution patches affecting Windows Telephony Services, for instance, or the 17 elevation-of-privilege issues addressed in Windows Digital Media. Eight of the Windows patches are critical-severity, including the OLE-involved Outlook bug noted above. (We’ll look more closely at that situation in a minute.)

At patch time, three important-severity EoP issues, all titled “Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability,” are known to be under exploit in the wild, with 17 additional CVEs more likely to be exploited in the next 30 days by the company’s estimation. Two of this month’s issues are amenable to detection by Sophos protections, and we include information on those in a table below.

In addition to these patches, the release includes advisory information on Servicing Stack Updates, as well as information on the month’s single Edge patch (there is also an Internet Explorer patch, as we’ll discuss below) and two issues covered in the release but already mitigated by Microsoft. We are as always including at the end of this post additional appendices listing all Microsoft’s patches, sorted by severity, by predicted exploitability, and by product family; an appendix covering the advisory-style updates; and a breakout of the 130 patches affecting the various Windows Server platforms still in support.

• Total CVEs: 159
• Publicly disclosed: 3
• Exploit detected: 3
• Severity
  • Critical: 9
  • Important: 150
• Impact
  • Remote Code Execution: 58
  • Elevation of Privilege: 40
  • Information Disclosure: 22
  • Denial of Service: 20
  • Security Feature Bypass: 14
  • Spoofing: 5
• CVSS base score 9.0 or greater: 3
• CVSS base score 8.0 or greater: 40

Figure 1: Though RCE continues to rule the roost, a variety of impacts are represented in the first patch haul of the year

Products

• Windows: 132
• 365: 13
• Office: 13
• Visual Studio: 7
• .NET: 4
• Access: 3
• SharePoint: 3
• Office for Mac: 2
• AutoUpdate for Mac: 1
• Excel: 1
• Outlook: 1
• On-Premises Data Gateway: 1
• Power Automate: 1

As is our custom for this list, CVEs that apply to more than one product family are counted once for each family they affect.

Figure 2: All but two of January’s Windows patches apply to the server-side OS. As for the rest, Office for Mac gets a single patch all to iteself and shares one with other versions of Office

Notable January updates

In addition to the issues discussed above, a number of specific items merit attention.

CVE-2025-21298 — Windows OLE Remote Code Execution Vulnerability

With a CVSS base score of 9.8, this critical-severity issue is already attention-getting, but it’s even more exciting than that. This is an RTF (Rich Text Format) issue, so though it must be corrected in Windows it applies to various products, in particular email. Since the flaw can be triggered in Preview Pane, an attacker deploying this vulnerability would have to do nothing more than send a malicious email to the target; even if the user doesn’t click on anything, simply viewing it is sufficient to set off RCE. Fortunately it’s not yet believed to be under active exploit in the wild – the finders worked with The Zero-Day Initiative to bring it to Microsoft’s attention – but it’s reasonable to assume the clock is ticking. As noted above, the company does indeed recommend that users stick with reading their email in plaintext, and gives the instructions for configuring individual machines to do so in Outlook. Users of other email programs will wish to take note and act accordingly.

CVE-2025-21311 — Windows NTLM V1 Elevation of Privilege Vulnerability

Another 9.8 on CVSS’s scale, this one applies to Microsoft’s most recent offerings (Windows 11 24H2, Server 2022 23H2, Server 2025) and is relatively easy to mitigate by setting LmCompatibilityLevel to its maximum value of 5, thus disallowing usage of the MTLMv1 protocol. That’s good, because the vulnerability is remotely exploitable, requires no particular knowledge of the target system, and has a high success rate.

CVE-2025-21366, CVE-2025-21395, CVE-2025-21186 – all Microsoft Access Remote Code Execution Vulnerability

Continuing this month’s theme of “changes to email functionality that’ll make end users cranky,” the patches for these CVEs all block seven potentially malicious extensions (.accda, .accdb, .accde,  .accdr, accdt, .accdu, .accdw) from being sent via email. Microsoft states that the recipient will get a notification that there was an attachment but that it cannot be accessed. All three issues are RCE aimed at RDP, and all three are already publicly known.

CVE-2025-21280, CVE-2025-21284, CVE-2025-21299, CVE-2025-21321, CVE-2025-21331, CVE-2025-21336, CVE-2025-21340, CVE-2025-21370 – various titles

Eight of this month’s patches involve Virtual Secure Mode components, which means that administrators need to follow Microsoft’s guidance for updating virtualization-based security (VBS) issues.

CVE-2025-21343 — Windows Web Threat Defense User Service Information Disclosure Vulnerability

An Important-severity information-disclosure issue, this oddity can, if exploited, allow the attacker to capture screenshots of another user’s session. It’s likewise rather specific in scope, affecting only Windows 11 22H2, 23H2, and 24H2. It was submitted to Microsoft by an uncommon finder, the Australian Signals Directorate.

CVE-2025-21326 — Internet Explorer Remote Code Execution Vulnerability

Seems like old times with a name like that, but this important-severity RCE affects not the browser of yore but Windows Server 2022 23H2 and Windows Server 2025.

Figure 3: This spike at the right edge? There we are

Sophos protections

As you can every month, if you don’t want to wait for your system to pull down Microsoft’s updates itself, you can download them manually from the Windows Update Catalog website. Run the winver.exe tool to determine which build of Windows 10 or 11 you’re running, then download the Cumulative Update package for your specific system’s architecture and build number.

Appendix A: Vulnerability Impact and Severity

This is a list of January patches sorted by impact, then sub-sorted by severity. Each list is further arranged by CVE.

Remote Code Execution (58 CVEs)

Elevation of Privilege (40 CVEs)

Information Disclosure (22 CVEs)

Denial of Service (20 CVEs)

Security Feature Bypass (14 CVEs)

Spoofing (5 CVEs)

Appendix B: Exploitability

This is a list of the January CVEs judged by Microsoft to be either under exploitation in the wild or more likely to be exploited in the wild within the first 30 days post-release. The list is arranged by CVE.

Appendix C: Products Affected

This is a list of January’s patches sorted by product family, then sub-sorted by severity. Each list is further arranged by CVE. Patches that are shared among multiple product families are listed multiple times, once for each product family. Issues affecting Windows Server are further sorted in Appendix E. Please note that Office for Mac has a standalone entry for CVE-2025-21361, which affects only that platform.

Windows (132 CVEs)

365 (13 CVEs)

Office (13 CVEs)

Visual Studio (7 CVEs)

.NET (4 CVEs)

Access (3 CVEs)

SharePoint (3 CVEs)

Office for Mac (2 CVEs)

AutoUpdate for Mac (1 CVE)

Excel (1 CVE)

Outlook (1 CVE)

On-Premises Data Gateway (1 CVE)

Power Automate (1 CVE)

Appendix D: Advisories and Other Products

This is a list of advisories and information on other relevant CVEs in the January release. The issues addressed in the three CVEs have already been mitigated by Microsoft, but were listed in the release in the interests of transparency.

Microsoft information:

There are no Adobe advisories in this month’s release.

Appendix E: Affected Windows Server versions

This is a table of CVEs in the January release affecting nine Windows Server versions, 2008 through 2025. The table differentiates among major versions of the platform but doesn’t go into deeper detail (eg., Server Core). Critical-severity issues are marked in red; an “x” indicates that the CVE does not apply to that version. Administrators are encouraged to use this appendix as a starting point to ascertain their specific exposure, as each reader’s situation, especially as it concerns products out of mainstream support, will vary. For specific Knowledge Base numbers, please consult Microsoft.