Executive brief
A vulnerability in the Microsoft Windows Kernel allows an attacker who already has limited access to a computer to gain full administrative control. This type of flaw is often used by hackers to bypass security restrictions and install malicious software or steal sensitive data. This vulnerability is currently being exploited in the wild, making immediate patching a high priority for all Windows users and administrators.
Technical details
A race condition (CWE-362) and potential double-free (CWE-415) vulnerability exists in the Microsoft Windows Kernel due to improper synchronization when handling shared resources. An attacker with local access and low privileges can exploit this flaw by timing concurrent executions to manipulate kernel memory. Successful exploitation allows the attacker to elevate their privileges to SYSTEM level. This vulnerability has been observed in active exploitation, and Microsoft has released security updates to address the issue across supported versions of Windows and Windows Server.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 23H2, 24H2, 25H2
- Microsoft Windows Server 2019 All versions
- Microsoft Windows Server 2022 All versions
- Microsoft Windows Server 2025 All versions
Timeline
- 2025-11-11: disclosed: Initial disclosure by Microsoft
- 2025-11-12: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2025-11-12: advisory: NVD entry published