2025-01-14 - CVE Archive

CVE-2025-21364 Jan 14, 18:16 HIGH PATCH This Month

Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

Deserialization Microsoft 365 Apps Office Long Term Servicing Channel

NVD

CVSS 3.1

7.8

EPSS

0.2%

CVE-2025-21363 Jan 14, 18:16 HIGH PATCH This Month

Microsoft Word Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft 365 Apps Office Long Term Servicing Channel

NVD

CVSS 3.1

7.8

EPSS

1.7%

CVE-2025-21362 Jan 14, 18:16 HIGH PATCH CERT-EU This Month

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

RCE Use After Free Memory Corruption Microsoft 365 Apps +4

NVD

CVSS 3.1

8.4

EPSS

0.6%

CVE-2025-21360 Jan 14, 18:16 HIGH PATCH This Month

Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Privilege Escalation Microsoft Autoupdate

NVD

CVSS 3.1

7.8

EPSS

0.2%

CVE-2025-21356 Jan 14, 18:16 HIGH PATCH This Month

Microsoft Office Visio Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Buffer Overflow Heap Overflow Microsoft 365 Apps +2

NVD

CVSS 3.1

7.8

EPSS

1.0%

CVE-2025-21354 Jan 14, 18:16 HIGH PATCH CERT-EU This Month

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft 365 Apps Office Office Long Term Servicing Channel +1

NVD

CVSS 3.1

8.4

EPSS

1.5%

CVE-2025-21348 Jan 14, 18:16 HIGH PATCH This Month

Microsoft SharePoint Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

Authentication Bypass RCE Microsoft Sharepoint Server

NVD

CVSS 3.1

7.2

EPSS

0.8%

CVE-2025-21346 Jan 14, 18:16 HIGH PATCH This Month

Microsoft Office Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity.

Authentication Bypass Microsoft 365 Apps Office Office Long Term Servicing Channel

NVD

CVSS 3.1

7.1

EPSS

0.3%

CVE-2025-21345 Jan 14, 18:16 HIGH PATCH This Month

Microsoft Office Visio Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

RCE Use After Free Memory Corruption Microsoft 365 Apps +2

NVD

CVSS 3.1

7.8

EPSS

0.9%

CVE-2025-21344 Jan 14, 18:16 HIGH PATCH This Month

Microsoft SharePoint Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft Sharepoint Server

NVD

CVSS 3.1

7.8

EPSS

0.4%

CVE-2025-21343 Jan 14, 18:16 HIGH PATCH This Month

Windows Web Threat Defense User Service Information Disclosure Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Windows Privilege Escalation Information Disclosure Microsoft Windows 11 22h2 +2

NVD

CVSS 3.1

7.5

EPSS

5.4%

CVE-2025-21339 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

6.1%

CVE-2025-21335 Jan 14, 18:15 HIGH KEV PATCH THREAT CERT-EU Act Now

Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability for local privilege escalation, the third of three Hyper-V zero-days exploited in January 2025.

Windows Information Disclosure Use After Free Memory Corruption Microsoft +7

NVD

CVSS 3.1

7.8

EPSS

8.7%

CVE-2025-21334 Jan 14, 18:15 HIGH KEV PATCH THREAT CERT-EU Act Now

Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability allowing local privilege escalation, the second of three Hyper-V zero-days in January 2025.

Windows Information Disclosure Use After Free Memory Corruption Microsoft +7

NVD

CVSS 3.1

7.8

EPSS

6.6%

CVE-2025-21333 Jan 14, 18:15 HIGH POC KEV PATCH THREAT CERT-EU Act Now

Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow allowing authorized local attackers to escalate privileges, one of three Hyper-V zero-days exploited in January 2025 Patch Tuesday.

Windows Buffer Overflow Heap Overflow Microsoft Windows 10 21h2 +6

NVD Exploit-DB

CVSS 3.1

7.8

EPSS

81.8%

CVE-2025-21331 Jan 14, 18:15 HIGH PATCH This Month

Windows Installer Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.

Windows Information Disclosure Microsoft Windows 10 1507 Windows 10 1607 +11

NVD

CVSS 3.1

7.3

EPSS

0.5%

CVE-2025-21330 Jan 14, 18:15 HIGH PATCH This Month

Windows Remote Desktop Services Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Windows Denial Of Service Microsoft Windows 10 1809 Windows 10 21h2 +8

NVD

CVSS 3.1

7.5

EPSS

1.3%

CVE-2025-21326 Jan 14, 18:15 HIGH PATCH This Month

Internet Explorer Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Access of Resource Using Incompatible Type (Type Confusion) vulnerability could allow attackers to execute arbitrary code by exploiting type confusion in the application.

RCE Memory Corruption Microsoft Windows Server 2022 23h2 Windows Server 2025

NVD

CVSS 3.1

7.8

EPSS

0.6%

CVE-2025-21315 Jan 14, 18:15 HIGH PATCH This Month

Microsoft Brokering File System Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8). This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

Information Disclosure Use After Free Memory Corruption Microsoft Windows 11 24h2 +2

NVD

CVSS 3.1

7.8

EPSS

0.2%

CVE-2025-21309 Jan 14, 18:15 HIGH PATCH CERT-EU This Month

Windows Remote Desktop Services Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.

Windows RCE Microsoft Windows Server 2012 Windows Server 2016 +4

NVD

CVSS 3.1

8.1

EPSS

2.4%

CVE-2025-21306 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

1.7%

CVE-2025-21305 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

1.2%

CVE-2025-21304 Jan 14, 18:15 HIGH PATCH This Month

Microsoft DWM Core Library Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

Information Disclosure Use After Free Memory Corruption Microsoft Windows 10 1607 +5

NVD

CVSS 3.1

7.8

EPSS

0.3%

CVE-2025-21303 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

1.2%

CVE-2025-21302 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

1.2%

CVE-2025-21300 Jan 14, 18:15 HIGH PATCH This Month

Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Windows Denial Of Service Microsoft Windows 10 1507 Windows 10 1607 +13

NVD

CVSS 3.1

7.5

EPSS

1.3%

CVE-2025-21299 Jan 14, 18:15 HIGH PATCH This Month

Windows Kerberos Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity.

Windows Authentication Bypass Microsoft Windows 10 1507 Windows 10 1607 +11

NVD

CVSS 3.1

7.1

EPSS

0.6%

CVE-2025-21297 Jan 14, 18:15 HIGH PATCH CERT-EU This Month

Windows Remote Desktop Services Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

Windows RCE Use After Free Memory Corruption Microsoft +7

NVD

CVSS 3.1

8.1

EPSS

1.7%

CVE-2025-21296 Jan 14, 18:15 HIGH PATCH This Month

BranchCache Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

RCE Use After Free Memory Corruption Microsoft Windows 10 1507 +14

NVD

CVSS 3.1

7.5

EPSS

0.3%

CVE-2025-21295 Jan 14, 18:15 HIGH PATCH This Month

SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

RCE Use After Free Memory Corruption Microsoft Windows 10 1507 +14

NVD

CVSS 3.1

8.1

EPSS

1.7%

CVE-2025-21294 Jan 14, 18:15 HIGH PATCH CERT-EU This Month

Microsoft Digest Authentication Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.

RCE Microsoft Windows 10 1507 Windows 10 1607 Windows 10 1809 +12

NVD

CVSS 3.1

8.1

EPSS

1.9%

CVE-2025-21292 Jan 14, 18:15 HIGH PATCH This Month

Windows Search Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

Windows RCE Microsoft Code Injection Windows 10 1809 +9

NVD

CVSS 3.1

8.8

EPSS

0.5%

CVE-2025-21291 Jan 14, 18:15 HIGH PATCH This Month

Windows Direct Show Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Microsoft Windows 10 1809 Windows 10 21h2 +6

NVD

CVSS 3.1

8.8

EPSS

1.7%

CVE-2025-21290 Jan 14, 18:15 HIGH PATCH This Month

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Denial Of Service Microsoft Windows 10 1507 Windows 10 1607 Windows 10 1809 +12

NVD

CVSS 3.1

7.5

EPSS

1.3%

CVE-2025-21289 Jan 14, 18:15 HIGH PATCH This Month

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Denial Of Service Microsoft Windows 10 1507 Windows 10 1607 Windows 10 1809 +12

NVD

CVSS 3.1

7.5

EPSS

1.3%

CVE-2025-21287 Jan 14, 18:15 HIGH PATCH This Month

Windows Installer Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Windows Privilege Escalation Microsoft Windows 10 1507 Windows 10 1607 +13

NVD

CVSS 3.1

7.8

EPSS

0.2%

CVE-2025-21286 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

3.3%

CVE-2025-21285 Jan 14, 18:15 HIGH PATCH This Month

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 38.8%.

Denial Of Service Null Pointer Dereference Microsoft Windows 10 1507 Windows 10 1607 +13

NVD

CVSS 3.1

7.5

EPSS

38.8%

CVE-2025-21282 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

1.7%

CVE-2025-21281 Jan 14, 18:15 HIGH PATCH This Month

Microsoft COM for Windows Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

Windows Information Disclosure Use After Free Memory Corruption Microsoft +14

NVD

CVSS 3.1

7.8

EPSS

0.3%

CVE-2025-21277 Jan 14, 18:15 HIGH PATCH This Month

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 30.3%.

Buffer Overflow Denial Of Service Microsoft Windows 10 1507 Windows 10 1607 +13

NVD

CVSS 3.1

7.5

EPSS

30.3%

CVE-2025-21276 Jan 14, 18:15 HIGH PATCH This Month

Windows MapUrlToZone Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows Denial Of Service Integer Overflow Microsoft Windows 10 1507 +14

NVD

CVSS 3.1

7.5

EPSS

6.8%

CVE-2025-21275 Jan 14, 18:15 HIGH PATCH CERT-EU This Month

Windows App Package Installer Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Windows Authentication Bypass Microsoft Windows 10 21h2 Windows 10 22h2 +6

NVD

CVSS 3.1

7.8

EPSS

0.2%

CVE-2025-21273 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

1.7%

CVE-2025-21271 Jan 14, 18:15 HIGH PATCH This Month

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Windows Buffer Overflow Microsoft Windows 10 1809 Windows 10 21h2 +3

NVD

CVSS 3.1

7.8

EPSS

0.3%

CVE-2025-21270 Jan 14, 18:15 HIGH PATCH This Month

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Denial Of Service Microsoft Windows 10 1507 Windows 10 1607 Windows 10 1809 +12

NVD

CVSS 3.1

7.5

EPSS

1.3%

CVE-2025-21266 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

1.7%

CVE-2025-21252 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

1.7%

CVE-2025-21251 Jan 14, 18:15 HIGH PATCH This Month

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Denial Of Service Microsoft Windows 10 1507 Windows 10 1607 Windows 10 1809 +12

NVD

CVSS 3.1

7.5

EPSS

1.3%

CVE-2025-21250 Jan 14, 18:15 HIGH PATCH This Month

Windows Telephony Service Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Windows RCE Buffer Overflow Heap Overflow Microsoft +15

NVD

CVSS 3.1

8.8

EPSS

0.9%