Microsoft Patch Tuesday for January 2025 — Snort rules and prominent vulnerabilities

Summary: Microsoft's January 2025 security update covers 159 vulnerabilities, 12 of them rated critical, including CVE-2025-21298, a Windows OLE remote code execution flaw with a CVSS 3.1 score of 9.8 that can be triggered when a victim previews a malicious email in Outlook. Other critical entries include CVE-2025-21309 in Windows Remote Desktop Services (CVSS 8.1, marked more likely to be exploited), CVE-2025-21295 in the SPNEGO Extended Negotiation Security Mechanism requiring no user interaction, and CVE-2025-21311, a remotely exploitable NTLMv1 privilege escalation flaw.
Key Takeaway: CVE-2025-21298 scores 9.8 and fires from the Outlook preview pane, so a single malicious email can execute code before the recipient clicks anything; Microsoft's stated mitigation is to disable RTF, and for NTLMv1 it is to disable the protocol outright.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-21294 CVE-2025-21295 CVE-2025-21296 CVE-2025-21297 CVE-2025-21298 CVE-2025-21307 CVE-2025-21309 CVE-2025-21311 CVE-2025-21362 CVE-2025-21380 CVE-2025-21385
Related: Microsoft: Happy 2025. Here’s 161 Security Updates Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026