Patch Tuesday, February 2025
Microsoft's monthly security release, Tuesday, February 11, 2025. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 0 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 0 with public exploit code
- 7.8HighFeb 11, 2025Microsoft Windows Memory corruptionCVE-2025-21418Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.Exploited2.1% likely
- 7.1HighFeb 11, 2025Microsoft Windows Path traversal / file handlingCVE-2025-21391Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.Exploited2.3% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.