Biggest Patch Tuesday in years sees Microsoft address 159 vulnerabilities

Zero-days

Among the bumper crop of vulnerabilities are no less than eight zero-days, three that are known to have been exploited in the wild, and 11 critical flaws.

This month’s zero-days are as follows:

• CVE-2025-21333, an elevation of privilege (EoP) vuln in Windows Hyper-V NT Kernel VSP;
• CVE-2025-21334, a second EoP vulnerability in the same service;
• CVE-2025-21335, a third EoP vulnerability in the same service.

These flaws in Windows Hyper-V NT Kernel VSP are known to have been exploited in the wild, but these exploits have not yet been made public, while for the remaining five, the opposite is true. These are:

• CVE-2025-21186, a remote code execution (RCE) flaw in Microsoft Access;
• CVE-2025-21275, an EoP flaw in Windows App Package Installer;
• CVE-2025-21308, a spoofing flaw in Windows Themes;
• CVE-2025-21366, a second RCE flaw in Microsoft Access;
• CVE-2025-21395, a third RCE flaw in Microsoft Access.

Saaed Abbasi, vulnerability manager at the Qualys Threat Research Unit, said timely patching of the Hyper-V issues was critical since they are under active attack.

“They allow an authenticated user to elevate privileges to SYSTEM and let them take complete control of the affected environment,” said Abbasi.

“Usually, moving from guest to host/hypervisor indicates a CVSS [Common Vulnerability Scoring System] scope change, but Microsoft’s current disclosure has not explicitly confirmed this, suggesting further details are needed; this could jeopardise the entire host infrastructure, not just the individual VM [virtual machine].”

A threat actor able to achieve SYSTEM-level privileges is a grave concern to defenders, because it opens the door to other actions – such as disabling on-board security tooling, or credential dumping to pivot across domains within the target environment. Such techniques are frequently used by both financially motivated cyber criminal gangs and nation-state backed espionage operators.

Does you does or does you don't take Access?

Meanwhile, Adam Barnett, lead software engineer at Rapid7, ran the rule over the three similar RCE issues in Microsoft Access.

Barnett detailed how successful exploitation – should it occur – would require a user to be fooled into downloading and opening a malicious file, leading to code execution via a heap-based buffer overflow.

“Curiously, in each case, one portion of the advisory FAQ describes the update protection as ‘blocking potentially malicious extensions from being sent in an email’, but the remainder of the advisory doesn’t clarify how this would prevent malicious activity,” said Barnett.

“Typically, patches provide protection by blocking malicious files upon receipt of a malicious email attachment, rather than preventing a malicious attachment from being sent in the first place, since an attacker is free to send whatever they like from any system they control.

“At any rate, the FAQ does mention that users who would otherwise have interacted with a malicious attachment will instead receive a notification that there was an attachment but ‘it cannot be accessed’, which is perhaps the best play on words we’ve seen from MSRC in a while,” he said.

On the spoofing flaw in Windows Themes, Barnett said many admins and users may not think about this feature – which enables users to personalise their desktops with background images, screensavers and so on – very often if at all, but it was still essential to pay close attention to all aspects of the Windows estate.

“Successful exploitation leads to improper disclosure of an NTLM hash, which allows an attacker to impersonate the user from whom it was acquired,” he said.

“The advisory FAQ dances around the exploitation methodology without explaining; what we learn is that once an attacker had somehow delivered a malicious file to the target system, a user would need to manipulate the malicious file, but not necessarily click or open it.

“Without further detail, we can only speculate, but it’s plausible that simply opening a folder containing the file in Windows Explorer – including the Downloads folder – or inserting a USB drive, would be enough to trigger the vulnerability and see your NTLM hash leak silently for collection by the threat actor.”