Microsoft has released a new set of patches for its software portfolio, addressing a total of 161 security vulnerabilities, including three zero-days that have been actively exploited in attacks. The fixes include a trio of flaws in Windows Hyper-V NT Kernel Integration VSP that could grant SYSTEM privileges to attackers.
According to the Zero Day Initiative, this update marks the largest number of CVEs addressed in a single month since at least 2017. The patches also include fixes for critical severity vulnerabilities, such as Microsoft Digest Authentication Remote Code Execution and Windows Object Linking and Embedding (OLE) Remote Code Execution.
These vulnerabilities could allow attackers to execute remote code on affected systems without user interaction, or by exploiting weaknesses in the SPNEGO Extended Negotiation security mechanism. Users are advised to read email messages in plain text format and avoid opening RTF files from unknown or untrusted sources to reduce the risk of exploitation.
The patches are part of a larger effort by Microsoft and other vendors to address critical vulnerabilities across their software portfolios. Other companies that have released security updates include Adobe, Amazon Web Services, Arm, ASUS, Broadcom, Cisco, D-Link, Dell, Drupal, F5, Fortinet, GitHub, GitLab, Google Android and Pixel, Google Chrome, and others.
It is essential for users to keep their software up-to-date to prevent exploitation of these vulnerabilities.
Source: https://thehackernews.com/2025/01/3-actively-exploited-zero-day-flaws.html