CVE-2025-62215MicrosoftOperating systemsNovember 12, 2025

Microsoft Windows Race Condition Vulnerability

High 7Actively exploited

Description

Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Running Microsoft devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Microsoft alerts

Details

Vendor
Microsoft
Product
Windows
CVE
CVE-2025-62215
Affected versions
Windows 10 Version 1809 10.0: from 10.0.17763.0 to 10.0.17763.8027 (excluded) — fixed in 10.0.17763.8027
Windows 10 Version 21H2 10.0: from 10.0.19044.0 to 10.0.19044.6575 (excluded) — fixed in 10.0.19044.6575
Windows 10 Version 22H2 10.0: from 10.0.19045.0 to 10.0.19045.6575 (excluded) — fixed in 10.0.19045.6575
Windows 11 version 22H3 10.0: from 10.0.22631.0 to 10.0.22631.6199 (excluded) — fixed in 10.0.22631.6199
Windows 11 Version 23H2 10.0: from 10.0.22631.0 to 10.0.22631.6199 (excluded) — fixed in 10.0.22631.6199
Windows 11 Version 24H2 10.0: from 10.0.26100.0 to 10.0.26100.7171 (excluded) — fixed in 10.0.26100.7171
Windows 11 Version 25H2 10.0: from 10.0.26200.0 to 10.0.26200.7171 (excluded) — fixed in 10.0.26200.7171
Windows Server 2019 10.0: from 10.0.17763.0 to 10.0.17763.8027 (excluded) — fixed in 10.0.17763.8027
Windows Server 2019 (Server Core installation) 10.0: from 10.0.17763.0 to 10.0.17763.8027 (excluded) — fixed in 10.0.17763.8027
Windows Server 2022 10.0: from 10.0.20348.0 to 10.0.20348.4405 (excluded) — fixed in 10.0.20348.4405
Windows Server 2022, 23H2 Edition (Server Core installation) 10.0: from 10.0.25398.0 to 10.0.25398.1965 (excluded) — fixed in 10.0.25398.1965
Windows Server 2025 10.0: from 10.0.26100.0 to 10.0.26100.7171 (excluded) — fixed in 10.0.26100.7171
Windows Server 2025 (Server Core installation) 10.0: from 10.0.26100.0 to 10.0.26100.7171 (excluded) — fixed in 10.0.26100.7171 (from the advisory and NVD; check the exact builds in the official advisory)
CVSS score
7
Actively exploited
Yes, listed in the CISA Known Exploited Vulnerabilities catalog
CISA due date
December 3, 2025 (deadline for US federal agencies: a good benchmark for you too)
Source
CISA KEV – original advisory
Published
November 12, 2025

The description and the recommended action are quoted from the public advisory; severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More Microsoft advisories