The January 2025 security update for Windows 11, version 24H2 expands the list of vulnerable drivers that could be used in Bring Your Own Vulnerable Driver attacks. BYOVD Vulnerabilities in kernel drivers could allow threat actors to sneak malware into the kernel.

Yesterday was January’s big Patch Tuesday, where Microsoft rolled out a big bundle of security updates across several apps and services, eliminating 159 security vulnerabilities. This is the most extensive Patch Tuesday of the last few years with more than double the usual number of fixed security flaws.

All three zero-day vulnerabilities have a CVSS score of 7.8 and could allow an attacker to gain system privileges.

Microsoft released the first Patch Tuesday security updates for Windows addressing 159 CVEs with 8 zero-day threats discovered.

Microsoft has just released the January 2025 Patch Tuesday updates for Windows 11 and Windows 10, which only include security fixes.

Adam Barnett, lead software engineer at Rapid7, addresses Microsoft’s latest roll call of vulnerabilities, including eight that may already being exploited.