Microsoft Releases February 2025 Patch Tuesday Update Addressing 61 Vulnerabilities

February 12, 2025 – Microsoft has rolled out its February 2025 Patch Tuesday update, addressing a total of 61 vulnerabilities across its product ecosystem.

The update includes fixes for 25 critical Remote Code Execution (RCE) vulnerabilities, three of which are zero-day vulnerabilities actively exploited in the wild.

The security updates span a wide range of Microsoft products, including Windows, Office, Visual Studio, Azure, and the .NET Framework, emphasizing the need for organizations to act swiftly to mitigate potential threats.

Zero-Day Vulnerabilities: Actively Exploited Threats

Among the patched vulnerabilities, three zero-day flaws were identified as actively exploited:

1. CVE-2023-24932: A Secure Boot security feature bypasses vulnerability allowing attackers with physical access or administrative rights to install unauthorized boot policies.
2. CVE-2025-21391: A Windows Storage elevation of privilege vulnerability enabling attackers to delete critical data and disrupt services.
3. CVE-2025-21418: An elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock, potentially granting SYSTEM-level privileges to attackers.

Microsoft urges users to prioritize patching these zero-day vulnerabilities immediately to prevent further exploitation.

Critical Vulnerabilities: Remote Code Execution Risks

The February update also addresses several critical RCE vulnerabilities that pose significant risks if left unpatched. Notable examples include:

• CVE-2025-21376: A Windows Lightweight Directory Access Protocol (LDAP) RCE vulnerability enabling remote code execution.
• CVE-2025-21379: A DHCP Client Service RCE vulnerability that could allow attackers to execute code with elevated privileges remotely.
• CVE-2025-21381: An RCE vulnerability in Microsoft Excel triggered by malicious spreadsheet files.

These vulnerabilities highlight the importance of applying updates to prevent potential unauthorized access and system compromise.

Microsoft Patch Tuesday, February 2025 – 61 Vulnerabilities list

Call to Action for Organizations

Microsoft emphasizes the importance of applying these updates promptly, especially given the presence of actively exploited zero-day vulnerabilities and critical RCE flaws.

Cybersecurity professionals are encouraged to implement best practices, including regular system updates, monitoring for unusual activity, and ensuring administrative credentials are secure.

For detailed information on all vulnerabilities patched in this update, refer to Microsoft’s official documentation or consult your IT security team for guidance on deploying these updates effectively.

Also Read: