CVE-2025-62215: Microsoft Windows Kernel race condition privilege escalation

CVE-2025-62215 · Severity: critical · CVSS 7 · Exploited in the wild · Published 2025-11-12

A vulnerability in the Microsoft Windows Kernel allows an attacker who already has limited access to a computer to gain full administrative control. This type of flaw is often used by hackers to bypass security restrictions and install malicious software or steal sensitive data. This vulnerability is currently being exploited in the wild, making immediate patching a high priority for all Windows users and administrators.

Technologies: Microsoft Windows. Vendors: Microsoft.

Quick answers

Is CVE-2025-62215 exploited in the wild?
Yes. CVE-2025-62215 is known to be exploited in the wild, first recorded on 12 November 2025. Treat it as urgent.
How severe is CVE-2025-62215?
Critical severity, with a CVSS score of 7, published 12 November 2025.
Which products and versions are affected?
Microsoft Windows 10 1809, 21H2, 22H2; Microsoft Windows 11 23H2, 24H2, 25H2; Microsoft Windows Server 2019 All versions; Microsoft Windows Server 2022 All versions; and 1 more.
Is there a fix for CVE-2025-62215?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-62215 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-62215?
Check whether you run Microsoft Windows. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition (CWE-362) and potential double-free (CWE-415) vulnerability exists in the Microsoft Windows Kernel due to improper synchronization when handling shared resources. An attacker with local access and low privileges can exploit this flaw by timing concurrent executions to manipulate kernel memory. Successful exploitation allows the attacker to elevate their privileges to SYSTEM level. This vulnerability has been observed in active exploitation, and Microsoft has released security updates to address the issue across supported versions of Windows and Windows Server.

Affected products

  • Microsoft Windows 10 1809, 21H2, 22H2
  • Microsoft Windows 11 23H2, 24H2, 25H2
  • Microsoft Windows Server 2019 All versions
  • Microsoft Windows Server 2022 All versions
  • Microsoft Windows Server 2025 All versions

Timeline

  • 2025-11-11: disclosed: Initial disclosure by Microsoft
  • 2025-11-12: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2025-11-12: advisory: NVD entry published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.