As we navigate through the second Patch Tuesday of 2025, the tech landscape continues to evolve, with Microsoft and Adobe unveiling their latest security patches. This month’s updates are particularly noteworthy, addressing a range of vulnerabilities that could potentially impact users and organizations alike.
Adobe Patches for February 2025
Adobe has rolled out seven bulletins this February, tackling a total of 45 CVEs across various products, including Adobe InDesign, Commerce, Substance 3D Stager, InCopy, Illustrator, Substance 3D Designer, and Adobe Photoshop Elements. The most significant update comes from Adobe Commerce, which addresses 31 CVEs. Among these, several critical vulnerabilities have been identified, including:
- InDesign: The update resolves seven bugs, four of which are rated Critical.
- Illustrator: Three critical bugs could lead to arbitrary code execution when a malicious file is opened.
- Substance 3D Stager: A single DoS bug has been fixed.
- InCopy: This patch addresses a critical-rated code execution vulnerability.
- Substance 3D Designer: Similar to InCopy, this patch also fixes a critical-rated code execution issue.
- Photoshop Elements: An important-rated privilege escalation vulnerability has been addressed.
Importantly, none of the vulnerabilities patched by Adobe this month are publicly known or under active attack at the time of release, with the updates categorized as a deployment priority rating of 3.
Microsoft Patches for February 2025
On the Microsoft front, the company has released patches for 57 new CVEs affecting Windows and its components, Office, Azure, Visual Studio, and Remote Desktop Services. This brings the total count to 67 CVEs when including third-party submissions through the Trend ZDI program. The severity ratings for this month’s patches are as follows:
- 3 rated Critical
- 53 rated Important
- 1 rated Moderate
After a series of record-breaking releases, this month’s volume of fixes aligns more closely with industry expectations, and there is hope that this trend will continue throughout 2025. Notably, two of the vulnerabilities are publicly known, while two others are under active attack. Here’s a closer look at some of the more critical updates:
- CVE-2025-21391 – Windows Storage Elevation of Privilege Vulnerability: This vulnerability allows attackers to delete targeted files, leading to privilege escalation. It’s a type of bug not previously seen exploited publicly, making it imperative to test and deploy the patch swiftly.
- CVE-2025-21418 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability: This traditional privilege escalation vulnerability requires an authenticated user to run a specially crafted program. While Microsoft hasn’t disclosed the extent of the attacks, rapid testing and deployment of the patch is advised.
- CVE-2025-21376 – Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability: This allows a remote, unauthenticated attacker to execute code on an affected system by sending a malicious request. Given its potential for worm-like exploitation, prompt action is recommended.
- CVE-2025-21387 – Microsoft Excel Remote Code Execution Vulnerability: This vulnerability can be exploited through the Preview Pane in Excel, requiring user interaction. Multiple patches are necessary to fully address this issue, so thorough testing and deployment are essential.
For a comprehensive overview of all the CVEs released by Microsoft this month, further details can be found in their official documentation.
