MS Family February 2025 Routine Security Update Advisory

Feb 12 2025

Overview

Microsoft(https://www.microsoft.com) has released a security update that fixes vulnerabilities in products it has supplied. Users of affected products are advised to update to the latest version.

Affected Products

Apps family

Microsoft Outlook for Android

Microsoft PC Manager

Azure Suite

Azure Network Watcher VM Extension

Microsoft HPC Pack 2016

Microsoft HPC Pack 2019

Developer Tools suite

Microsoft Visual Studio 2017 version 15.9 (includes 15.0 – 15.8)

Microsoft Visual Studio 2019 version 16.11 (includes 16.0 – 16.10)

Microsoft Visual Studio 2022 version 17.10

Microsoft Visual Studio 2022 version 17.12

Microsoft Visual Studio 2022 version 17.8

Visual Studio Code

Visual Studio Code – JS Debug Extension

Device Family

Microsoft Surface Go 2

Microsoft Surface Go 3

Microsoft Surface Hub

Microsoft Surface Hub 2S

Microsoft Surface Hub 3

Microsoft Surface Laptop Go

Microsoft Surface Laptop Go 2

Microsoft Surface Laptop Go 3

Microsoft Surface Pro 7

Microsoft Surface Pro 8

Microsoft Surface Pro 9 ARM

Surface Laptop 3 with Intel Processor

Surface Laptop 4 with AMD Processor

Surface Laptop 4 with Intel Processor

Surface Windows Dev Kit

ESU Family

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2012

Windows Server 2012 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 R2 (Server Core installation)

Mariner family

Azure Linux 3.0 ARM

Azure Linux 3.0 x64

CBL Mariner 2.0 ARM

CBL Mariner 2.0 x64

Microsoft Office Suite

Microsoft 365 Apps for Enterprise for 32-bit Systems

Microsoft 365 Apps for Enterprise for 64-bit Systems

Microsoft AutoUpdate for Mac

Microsoft Excel 2016 (32-bit edition)

Microsoft Excel 2016 (64-bit edition)

Microsoft Office 2016 (32-bit edition)

Microsoft Office 2016 (64-bit edition)

Microsoft Office 2019 for 32-bit editions

Microsoft Office 2019 for 64-bit editions

Microsoft Office LTSC 2021 for 32-bit editions

Microsoft Office LTSC 2021 for 64-bit editions

Microsoft Office LTSC 2024 for 32-bit editions

Microsoft Office LTSC 2024 for 64-bit editions

Microsoft Office LTSC for Mac 2021

Microsoft Office LTSC for Mac 2024

Microsoft SharePoint Enterprise Server 2016

Microsoft SharePoint Server 2019

Microsoft SharePoint Server Subscription Edition

Office Online Server

Windows Family

Windows 10 Version 1607 for 32-bit Systems

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 22H2 for 32-bit Systems

Windows 10 Version 22H2 for ARM64-based Systems

Windows 10 Version 22H2 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 11 Version 22H2 for ARM64-based Systems

Windows 11 Version 22H2 for x64-based Systems

Windows 11 Version 23H2 for ARM64-based Systems

Windows 11 Version 23H2 for x64-based Systems

Windows 11 Version 24H2 for ARM64-based Systems

Windows 11 Version 24H2 for x64-based Systems

Windows Server 2016

Windows Server 2016 (Server Core installation)

Windows Server 2019

Windows Server 2019 (Server Core installation)

Windows Server 2022

Windows Server 2022 (Server Core installation)

Windows Server 2022, 23H2 Edition (Server Core installation)

Windows Server 2025

Windows Server 2025 (Server Core installation)

Resolved Vulnerabilities

3 vulnerabilities rated Critical and 53 rated Important were found.

Apps suite

Critical elevation of privilege vulnerability in Microsoft PC Manager (CVE-2025-21322)

Critical spoofing vulnerability in Outlook for Android (CVE-2025-21259)

Azure Family

Critical elevation of privilege vulnerability in Azure Network Watcher (CVE-2025-21188)

Critical remote code execution vulnerability in Microsoft High Performance Compute Pack (HPC) Linux Node Agent (CVE-2025-21198)

Developer Tools Suite

Critical remote code execution vulnerability in Open Source Software (CVE-2023-32002)

Critical elevation of privilege vulnerabilities in Visual Studio Code (CVE-2025-24039, CVE-2025-24042)

Critical elevation of privilege vulnerability in Visual Studio (CVE-2025-21206)

Device Family

Critical security feature bypass vulnerability in Microsoft Surface (CVE-2025-21194)

Mariner Family

Microsoft Office Suite

Critical elevation of privilege vulnerability in Microsoft AutoUpdate (MAU) (CVE-2025-24036)

Critical remote code execution vulnerability in Microsoft Office Excel (CVE-2025-21381)

Critical-grade remote code execution vulnerabilities in Microsoft Office Excel (CVE-2025-21386, CVE-2025-21387, CVE-2025-21390, CVE-2025-21394)

Critical information disclosure vulnerability in Microsoft Office Excel (CVE-2025-21383)

Critical remote code execution vulnerability in Microsoft Office SharePoint (CVE-2025-21400)

Critical remote code execution vulnerabilities in Microsoft Office (CVE-2025-21392, CVE-2025-21397)

Windows Family

Critical-grade denial-of-service vulnerability in Active Directory Domain Services (CVE-2025-21351)

Critical remote code execution vulnerabilities in Microsoft Digest Authentication (CVE-2025-21368, CVE-2025-21369)

Critical elevation of privilege vulnerability in Microsoft Streaming Service (CVE-2025-21375)

Critical elevation of privilege vulnerability in Microsoft Windows (CVE-2025-21337)

Critical elevation of privilege vulnerability in Windows Ancillary Function Driver for WinSock (CVE-2025-21418)

Critical elevation of privilege vulnerability in Windows CoreMessaging (CVE-2025-21358, CVE-2025-21184)

Critical denial of service vulnerability in Windows DHCP Client (CVE-2025-21179)

Critical remote code execution vulnerability in Windows DHCP Server (CVE-2025-21379)

Critical elevation of privilege vulnerability in Windows DWM Core Library (CVE-2025-21414)

Critical elevation of privilege vulnerability in Windows Disk Cleanup Tool (CVE-2025-21420)

Critical elevation of privilege vulnerability in Windows Installer (CVE-2025-21373)

Critical denial of service vulnerabilities in Windows Internet Connection Sharing (ICS) (CVE-2025-21352, CVE-2025-21212, CVE-2025-21216, CVE-2025-21254)

Critical-grade denial-of-service vulnerability in Windows Kerberos (CVE-2025-21350)

Critical Security Feature Bypass Vulnerability in Windows Kernel (CVE-2025-21359)

Critical remote code execution vulnerability in Windows LDAP – Lightweight Directory Access Protocol (CVE-2025-21376)

Critical denial of service vulnerability in Windows Message Queuing (CVE-2025-21181)

Critical-grade spoofing vulnerability in Windows NTLM (CVE-2025-21377)

Critical Tampering Vulnerability in Windows Remote Desktop Services (CVE-2025-21349)

Critical elevation of privilege vulnerabilities in Windows Resilient File System (ReFS) Deduplication Service (CVE-2025-21182, CVE-2025-21183)

Critical remote code execution vulnerabilities in Windows Routing and Remote Access Service (RRAS) (CVE-2025-21208, CVE-2025-21410)

Critical elevation of privilege vulnerability in Windows Setup Files Cleanup (CVE-2025-21419)

Critical elevation of privilege vulnerability in Windows Storage (CVE-2025-21391)

Critical remote code execution vulnerability in Windows Telephony Server (CVE-2025-21201)

Critical remote code execution vulnerabilities in Windows Telephony Service (CVE-2025-21406, CVE-2025-21407, CVE-2025-21190, CVE-2025-21200, CVE-2025-21371)

Critical-grade denial-of-service vulnerability in the Windows Update Stack (CVE-2025-21347)

Critical elevation of privilege vulnerability in the Windows Win32 Kernel Subsystem (CVE-2025-21367)

Vulnerability Patches

The following product-specific vulnerability patches were made available in the February 11, 2025 Update Please use the Windows Update feature for automatic installation or refer to the URLs in the product information below to download and install.

Azure Linux 3.0 ARM versions

Azure Linux 3.0 x64 version

https://www.catalog.update.microsoft.com/Search.aspx?q=KBaccountsservice

https://www.catalog.update.microsoft.com/Search.aspx?q=KBLibRaw

https://www.catalog.update.microsoft.com/Search.aspx?q=KBpuppet

https://www.catalog.update.microsoft.com/Search.aspx?q=KBkubevirt

https://www.catalog.update.microsoft.com/Search.aspx?q=KBapplication-gateway-kubernetes-ingress

https://www.catalog.update.microsoft.com/Search.aspx?q=KBkata-containers

https://www.catalog.update.microsoft.com/Search.aspx?q=KBkata-containers-cc

https://www.catalog.update.microsoft.com/Search.aspx?q=KBsriov-network-device-plugin

https://www.catalog.update.microsoft.com/Search.aspx?q=KBvitess

https://www.catalog.update.microsoft.com/Search.aspx?q=KBorc