Microsoft releases February 2025 patch, fixes 4 zero-days, 3 critical and a total of 57 flaws

Microsoft has released its February 2025 Patch Tuesday security updates, addressing 57 unique vulnerabilities across 13 product families. 

This release represents a significant decrease from January's patch volume of 159 CVEs. The patches cover various Microsoft products including Windows, Office, Azure, and other core services.

Four zero-day vulnerabilities are patched:

• CVE-2025-21391 (CVSS score 7.1) actively exploited in the wild - Windows Storage Elevation of Privilege Vulnerability. Allows attackers to delete targeted files on a system without user interaction. Can affect data availability but cannot disclose confidential information
• CVE-2025-21418 (CVSS score 7.8) actively exploited in the wild - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability. Allows attackers to gain SYSTEM privileges, but requires local access to the target machine. Could be used to disable security tools or enable lateral movement
• CVE-2025-21198 (CVSS score 9.0) - Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability. Requires access to the network connecting targeted clusters and exploitable through malicious HTTPS requests
• CVE-2025-21194 (CVSS score 7.1) - Microsoft Surface Security Feature Bypass Vulnerability. Allows attackers to bypass UEFI security and potentially compromise both the hypervisor and secure kernel. Exploit requires specific hardware configurations, access to a restricted network and a system reboot is necessary for exploitation.
• CVE-2025-21377 (CVSS score 6.5) - NTLM Hash Disclosure Spoofing Vulnerability. Affects Windows systems using NTLM authentication. It exposes user NTLM hashes, potentially allowing unauthorized access

Microsoft also warns of these three flaws as critical:

• CVE-2025-21376 (CVSS score 8.1) - Windows LDAP Remote Code Execution Vulnerability. Likely to be exploited in the next 30 days
• CVE-2025-21381 (CVSS score 7.8) - Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-21379 (CVSS score 7.1) - DHCP Client Service Remote Code Execution Vulnerability. Could enable attackers to compromise systems via crafted network packets

Microsoft recommends that users and administrators apply these updates as soon as possible through Windows Update, Microsoft Update Catalog, or WSUS for enterprise environments.

Full list of patched vulnrabilities