Patch Tuesday, January 2025
Microsoft's monthly security release, Tuesday, January 14, 2025. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
3 CVEs · 0 critical · 3 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
3 CVEs · 0 critical · 3 exploited · 1 with public exploit code
- 7.8HighJan 14, 2025Microsoft Windows Memory corruptionCVE-2025-21333Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.Exploited10% likelyExploit codeExploit-DB
- 7.8HighJan 14, 2025Microsoft Windows Memory corruptionCVE-2025-21334Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.Exploited1.6% likely
- 7.8HighJan 14, 2025Microsoft Windows Memory corruptionCVE-2025-21335Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.Exploited1.4% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.