Microsoft Patch Tuesday · February 2025
MicrosoftScheduled
72
Total
Deduplicated CVEs in this cycle. For Microsoft, only CVEs first published on Patch Tuesday itself count, excluding browser updates, late additions and cloud fixes.
2
Critical
CVEs with CVSS 9.0 or higher (critical per NVD scale).
2
Zero-day
Actively exploited at time of disclosure (CISA KEV or vendor-confirmed).
2
KEV
Listed in CISA's Known Exploited Vulnerabilities catalog: mandatory for US agencies, best practice for everyone.
2 zero-days / actively exploited
These vulnerabilities were exploited before or at the time the patch was released. Install the related updates first.
| High | CVE-2025-21418 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Listed in CISA KEV | KB5052000 | 7.8 |
| High | CVE-2025-21391 | Windows Storage Elevation of Privilege Vulnerability Listed in CISA KEV | KB5052000 | 7.1 |
By product family
Unassigned50 CVEs
| Critical | CVE-2023-32002 | The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. | — | 9.8 |
| Critical | CVE-2025-21198 | Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability | — | 9.0 |
| High | CVE-2025-21190 | Windows Telephony Service Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21200 | Windows Telephony Service Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21201 | Windows Telephony Server Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21208 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21368 | Microsoft Digest Authentication Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21369 | Microsoft Digest Authentication Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21371 | Windows Telephony Service Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21406 | Windows Telephony Service Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21407 | Windows Telephony Service Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21410 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | KB5052000 | 8.8 |
| High | CVE-2025-21376 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | KB5052000 | 8.1 |
| High | CVE-2025-21322 | Microsoft PC Manager Elevation of Privilege Vulnerability | — | 7.8 |
| High | CVE-2025-21358 | Windows Core Messaging Elevation of Privileges Vulnerability | KB5052000 | 7.8 |
| High | CVE-2025-21359 | Windows Kernel Security Feature Bypass Vulnerability | KB5052000 | 7.8 |
| High | CVE-2025-21367 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability | KB5052000 | 7.8 |
| High | CVE-2025-21373 | Windows Installer Elevation of Privilege Vulnerability | KB5052000 | 7.8 |
| High | CVE-2025-21375 | Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability | KB5052000 | 7.8 |
| High | CVE-2025-21381 | Microsoft Excel Remote Code Execution Vulnerability | KB5002679 | 7.8 |
| High | CVE-2025-21383 | Microsoft Excel Information Disclosure Vulnerability | KB5002179 | 7.8 |
| High | CVE-2025-21386 | Microsoft Excel Remote Code Execution Vulnerability | KB5002679 | 7.8 |
| High | CVE-2025-21387 | Microsoft Excel Remote Code Execution Vulnerability | KB5002679 | 7.8 |
| High | CVE-2025-21390 | Microsoft Excel Remote Code Execution Vulnerability | KB5002679 | 7.8 |
| High | CVE-2025-21394 | Microsoft Excel Remote Code Execution Vulnerability | KB5002679 | 7.8 |
| High | CVE-2025-21420 | Windows Disk Cleanup Tool Elevation of Privilege Vulnerability | KB5051979 | 7.8 |
| High | CVE-2025-21181 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | KB5052000 | 7.5 |
| High | CVE-2025-21351 | Windows Active Directory Domain Services API Denial of Service Vulnerability | KB5052000 | 7.5 |
| High | CVE-2025-21182 | Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability | KB5051987 | 7.4 |
| High | CVE-2025-21183 | Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability | KB5051987 | 7.4 |
| High | CVE-2025-21206 | Visual Studio Installer Elevation of Privilege Vulnerability | — | 7.3 |
| High | CVE-2025-24039 | Visual Studio Code Elevation of Privilege Vulnerability | — | 7.3 |
| High | CVE-2025-24042 | Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability | — | 7.3 |
| High | CVE-2025-21194 | Microsoft Surface Security Feature Bypass Vulnerability Publicly disclosed | — | 7.1 |
| High | CVE-2025-21379 | DHCP Client Service Remote Code Execution Vulnerability | KB5051987 | 7.1 |
| High | CVE-2025-21419 | Windows Setup Files Cleanup Elevation of Privilege Vulnerability | KB5052000 | 7.1 |
| High | CVE-2025-21184 | Windows Core Messaging Elevation of Privileges Vulnerability | KB5052000 | 7.0 |
| High | CVE-2025-21414 | Windows Core Messaging Elevation of Privileges Vulnerability | KB5052000 | 7.0 |
| High | CVE-2025-24036 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability | — | 7.0 |
| Medium | CVE-2025-21349 | Windows Remote Desktop Configuration Service Tampering Vulnerability | KB5052000 | 6.8 |
| Medium | CVE-2025-21212 | Internet Connection Sharing (ICS) Denial of Service Vulnerability | KB5052000 | 6.5 |
| Medium | CVE-2025-21216 | Internet Connection Sharing (ICS) Denial of Service Vulnerability | KB5052000 | 6.5 |
| Medium | CVE-2025-21254 | Internet Connection Sharing (ICS) Denial of Service Vulnerability | KB5052000 | 6.5 |
| Medium | CVE-2025-21352 | Internet Connection Sharing (ICS) Denial of Service Vulnerability | KB5052000 | 6.5 |
| Medium | CVE-2025-21377 | NTLM Hash Disclosure Spoofing Vulnerability Publicly disclosed | KB5052000 | 6.5 |
| Medium | CVE-2025-21347 | Windows Deployment Services Denial of Service Vulnerability | KB5052000 | 6.0 |
| Medium | CVE-2025-21350 | Windows Kerberos Denial of Service Vulnerability | KB5052000 | 5.9 |
| Medium | CVE-2025-21259 | Microsoft Outlook Spoofing Vulnerability | — | 5.3 |
| Medium | CVE-2025-21179 | DHCP Client Service Denial of Service Vulnerability | KB5051987 | 4.8 |
| Low | CVE-2025-21337 | Windows NTFS Elevation of Privilege Vulnerability | KB5052000 | 3.3 |
Edge8 CVEs
| High | CVE-2025-21342 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | — | 8.8 |
| High | CVE-2025-21408 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | — | 8.8 |
| Medium | CVE-2025-21279 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | — | 6.5 |
| Medium | CVE-2025-21283 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | — | 6.5 |
| Medium | CVE-2025-21253 | Microsoft Edge for IOS and Android Spoofing Vulnerability | — | 5.3 |
| Medium | CVE-2025-21401 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | — | 4.5 |
| Medium | CVE-2025-21267 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | — | 4.4 |
| Medium | CVE-2025-21404 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | — | 4.3 |
Chromium7 CVEs
| High | CVE-2025-0995 | Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | — | 8.8 |
| High | CVE-2025-0997 | Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. | — | 8.1 |
| Medium | CVE-2025-0444 | Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | — | 6.3 |
| Medium | CVE-2025-0451 | Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. | — | 6.3 |
| Medium | CVE-2025-0445 | Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | — | 5.4 |
| Medium | CVE-2025-0996 | Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. | — | 5.4 |
| Not rated | CVE-2025-0998 | — | — | 0.0 |
Office2 CVEs
| High | CVE-2025-21392 | Microsoft Office Remote Code Execution Vulnerability | KB5002686 | 7.8 |
| High | CVE-2025-21397 | Microsoft Office Remote Code Execution Vulnerability | — | 7.8 |
Dynamics1 CVE
| High | CVE-2025-21177 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network. | — | 8.7 |
SharePoint1 CVE
| High | CVE-2025-21400 | Microsoft SharePoint Server Remote Code Execution Vulnerability | KB5002685 | 8.0 |
Azure1 CVE
| Medium | CVE-2025-21188 | Azure Network Watcher VM Extension Elevation of Privilege Vulnerability | — | 6.0 |