Full Report
Microsoft today issued security updates to fix at least 56 vulnerabilities in its Windows operating systems and supported software, including two zero-day flaws that are being actively exploited.
Analysis Summary
# Vulnerability: Microsoft February 2025 Patch Tuesday Analysis
## CVE Details
- CVE ID: CVE-2025-21418
- CVSS Score: Not explicitly stated, but described as a priority due to active exploitation.
- CWE: Buffer Overflow (implied by description)
- CVE ID: CVE-2025-21391
- CVSS Score: Not explicitly stated.
- CWE: CWE-59 (Improper Link Resolution Before File Access)
- CVE ID: CVE-2025-21377
- CVSS Score: Not explicitly stated, but exploitation is assessed as "more likely."
- CWE: Not explicitly stated.
*(Note: Four other CVEs involving privilege elevation in the same Windows component as CVE-2024-38193 were mentioned, but no specific CVE IDs were provided for the new fixes.)*
## Affected Systems
- Products: Windows operating systems (all supported versions), Microsoft Office 365 / Microsoft 365 Copilot (related context, not directly tied to vulnerability IDs listed).
- Versions: All supported Windows operating systems.
- Configurations: Not specified for the primary flaws, though configuration details regarding NTLMv2 hash theft (CVE-2025-21377) imply an active Windows system.
## Vulnerability Description
The advisory covers 56 vulnerabilities, including two actively exploited zero-days:
1. **CVE-2025-21418 (Buffer Overflow):** A critical buffer overflow affecting a specific Windows component. This flaw is part of a component that has seen nine elevation of privilege vulnerabilities since 2022.
2. **CVE-2025-21391 (Elevation of Privilege):** A flaw in Windows Storage (CWE-59) allowing an attacker, without user interaction, to delete targeted files. Experts warn this could potentially be escalated to SYSTEM access via symbolic link misuse, moving beyond simple data loss.
3. **CVE-2025-21377 (Elevation of Privilege/Hash Theft):** A weakness allowing an attacker to steal NTLMv2 hashes with minimal user interaction (e.g., selecting or inspecting a malicious file). This allows the attacker to authenticate as the targeted user without logging in.
## Exploitation
- Status: **CVE-2025-21418** and **CVE-2025-21391** are **Actively Exploited** (Zero-Days). **CVE-2025-21377** exploitation is assessed as **more likely** by Microsoft analysts.
- Complexity: **Low** for CVE-2025-21418 and CVE-2025-21391.
- Attack Vector: **Network** (implied for file deletion/hash theft scenarios requiring minimal interaction).
## Impact
- Confidentiality: Impact likely High (CVE-2025-21377 allows NTLMv2 hash theft).
- Integrity: Impact likely High (CVE-2025-21391 allows file deletion, potentially leading to SYSTEM access).
- Availability: Impact Medium/High (Varies based on successful exploit; data deletion or system persistence possible).
## Remediation
### Patches
- Security updates released by Microsoft covering all 56 vulnerabilities, including fixes for CVE-2025-21418, CVE-2025-21391, and CVE-2025-21377. Administrators must apply all relevant February 2025 security updates for supported Windows operating systems.
- Updates are also expected for Chromium-based browsers (Microsoft Edge) following the Google Chrome update.
### Workarounds
- No specific vendor-provided workarounds were mentioned for the zero-day flaws in the summary, but applying the patches immediately is stressed as a priority.
## Detection
- Indicators of Compromise: Active monitoring is required, particularly looking for signs related to persistence mechanisms (following the Lazarus Group's use of FudModule rootkit in similar vulnerabilities).
- Detection methods and tools: General monitoring tools should scrutinize system calls related to file manipulation (for CVE-2025-21391) and network authentication attempts that may leverage stolen NTLMv2 hashes (for CVE-2025-21377).
## References
- Vendor advisories: Microsoft Security Update Guide for February 2025 (Specific URL is not provided).
- Related Links:
- Update guide link for CVE-2025-21418: hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418
- Update guide link for CVE-2025-21391: hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391
- Update guide link for CVE-2025-21377: hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21377
- SANS ISC Patch List: hxxps://isc.sans.edu/diary/Microsoft%20February%202025%20Patch%20Tuesday/31674
- Apple Fix Reference: hxxps://support.apple.com/en-us/122174 (for Apple CVE-2025-24200 context)