Windows Kernel CVE-2025-62215: Exploited Race to SYSTEM

What to do

1. Compare every host's build and UBR with the November 2025 fixed builds and install the latest cumulative update on anything older.
2. Enroll remaining Windows 10 22H2 devices in Extended Security Updates or upgrade them to Windows 11; unenrolled devices will never get this fix.
3. Prioritize hosts where many low-privilege users run code, such as Remote Desktop servers, VDI pools and shared jump hosts.
4. Keep EDR on every host, since this bug is used after an attacker already has code running.

How to check if you are affected or compromised

• Hunt EDR history from before your November 2025 patch date for low-privilege processes that spawned SYSTEM processes, or for new services and drivers.
• Review unexpected kernel crashes (System log Event ID 1001 BugCheck, Event ID 41 Kernel-Power) on unpatched hosts; failed attempts to win a kernel race may crash the machine.
• On Windows 10 devices outside ESU, assume local privilege escalation is possible and watch for credential dumping and security-tool tampering.

What happened#

On November 11, 2025, Microsoft fixed CVE-2025-62215, a race condition (CWE-362) in the Windows kernel that leads to a double free (CWE-415). It was the only bug that month that Microsoft marked "Exploitation Detected." The advisory says an authorized local attacker who wins the race can gain SYSTEM privileges. Microsoft's own threat intelligence (MSTIC) and MSRC are credited with finding it.

Microsoft scores it CVSS 3.1 7.0. The attack complexity is high only because the attacker must win a race; the CVE record also lists low privileges and no user interaction. CISA added it to the KEV catalog on November 12, 2025, with a December 3 federal deadline.

Microsoft has not said how it was used or by whom, and no one else has publicly as of Oct 23, 2026. Coverage in The Hacker News quotes Immersive's Ben McCarthy on the method: get "multiple threads to interact with a shared kernel resource in an unsynchronized way," so the kernel frees the same memory twice and corrupts its heap. Tenable's Satnam Narang assessed it was likely used after initial access gained through phishing or another bug.

Who is affected#

Windows 10 1809, 21H2 and 22H2; Windows 11 23H2, 24H2 and 25H2; and Windows Server 2019, 2022 and 2025. Server 2016 and older are not listed. Fixed builds include 26100.7171 for Windows 11 24H2 and Server 2025, 22631.6199 for Windows 11 23H2, 20348.4405 for Server 2022, 17763.8027 for Server 2019 and 19045.6575 for Windows 10 22H2.

Do you really need to act?#

For patched fleets, no. This is a second-stage bug: it turns a foothold into full control, letting an attacker disable security tools and dump credentials. It was the only zero-day in the first Patch Tuesday after Windows 10 support ended on October 14, 2025. The Windows 10 22H2 fix shipped only through Extended Security Updates, so unenrolled Windows 10 devices stay exploitable for good. Those devices are the real exposure today. Kernel races do get weaponized. An earlier Windows kernel race, CVE-2024-30088, is in KEV and flagged for known ransomware use.

What to do now#

1. Check builds with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object DisplayVersion,CurrentBuild,UBR, and install the latest cumulative update on anything below the November 2025 build.
2. Find Windows 10 22H2 devices without ESU and enroll or upgrade them.
3. Patch multi-user hosts first: Remote Desktop servers, VDI pools and shared jump hosts, where many low-privilege users run code.
4. Keep EDR on every host. It is the main control against post-compromise escalation.

How to tell if you were hit#

None of the sources above publish indicators of compromise as of Oct 23, 2026. Hunt EDR history for low-privilege processes that spawned SYSTEM processes, and for new services or drivers, on hosts that were unpatched after November 2025. Failed attempts to win a kernel race may crash the machine. Review unexplained bugchecks (System log Event ID 1001) and unexpected reboots (Event ID 41) on those hosts. Treat SYSTEM-level tampering with security tools as an incident.

Timeline#

• Oct 14, 2025 — Windows 10 support ends; later fixes for it ship only through ESU.
• Nov 11, 2025 — Microsoft fixes CVE-2025-62215 and reports exploitation.
• Nov 12, 2025 — CISA adds it to KEV.
• Dec 3, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2025-62215 · KEV 2025-11-12 · Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — CVE-2025-62215 Windows Kernel Elevation of Privilege Vulnerability msrc.microsoft.com
2. CVE record — CVE-2025-62215 cve.org
3. NVD — CVE-2025-62215 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-62215 cisa.gov
5. Microsoft — Windows 10 end of support microsoft.com
6. CVE record — CVE-2024-30088 cve.org

Coverage and analysis

1. The Hacker News — Microsoft Fixes 63 Security Flaws, Including a Windows Kernel Zero-Day Under Active Attack thehackernews.com