---
title: "Windows Kernel CVE-2025-62215: Exploited Race to SYSTEM"
url: https://erroneo.us/security/briefs/windows-kernel-cve-2025-62215-race-condition-eop/
description: "A Windows kernel race condition leading to a double free was exploited as a zero-day and fixed Nov 11, 2025. Patched fleets are fine; Windows 10 needs ESU."
type: security-brief
section: "Security Digest"
date_published: 2025-11-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-62215"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows Kernel CVE-2025-62215: Exploited Race to SYSTEM

**Verdict: Check exposure.** Patched in November 2025; the hosts still at risk are those behind on updates and Windows 10 devices outside Extended Security Updates, which never received this fix and should be enrolled or upgraded.

- **Who must act:** Owners of Windows 10 22H2 devices not enrolled in Extended Security Updates, and of any Windows 11 or Server 2019, 2022 or 2025 host below the November 2025 builds.
- **Who can relax:** Fleets on current cumulative updates; Microsoft does not list Windows Server 2016 or older releases as affected.
- **Affected:** Windows 10 1809, 21H2 and 22H2; Windows 11 23H2, 24H2 and 25H2; Windows Server 2019, Server 2022, Server 2022 23H2 edition and Server 2025; All before the November 11, 2025 updates
- **Fixed:** Windows 11 24H2 build 26100.7171 and 25H2 build 26200.7171 (KB5068861); Windows 11 23H2 build 22631.6199 (KB5068865); Windows 10 22H2 build 19045.6575 (KB5068781, Extended Security Updates); Windows Server 2025 build 26100.7171 (KB5068861); Windows Server 2022 build 20348.4405 (KB5068787); Windows Server 2019 build 17763.8027 (KB5068791)
- **CVEs:** CVE-2025-62215
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Compare every host's build and UBR with the November 2025 fixed builds and install the latest cumulative update on anything older.
2. Enroll remaining Windows 10 22H2 devices in Extended Security Updates or upgrade them to Windows 11; unenrolled devices will never get this fix.
3. Prioritize hosts where many low-privilege users run code, such as Remote Desktop servers, VDI pools and shared jump hosts.
4. Keep EDR on every host, since this bug is used after an attacker already has code running.

### How to check if you are affected

- Hunt EDR history from before your November 2025 patch date for low-privilege processes that spawned SYSTEM processes, or for new services and drivers.
- Review unexpected kernel crashes (System log Event ID 1001 BugCheck, Event ID 41 Kernel-Power) on unpatched hosts; failed attempts to win a kernel race may crash the machine.
- On Windows 10 devices outside ESU, assume local privilege escalation is possible and watch for credential dumping and security-tool tampering.

## What happened

On November 11, 2025, Microsoft fixed CVE-2025-62215, a race condition (CWE-362) in the Windows kernel that leads to a double free (CWE-415). It was the only bug that month that Microsoft marked "Exploitation Detected." The [advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215) says an authorized local attacker who wins the race can gain SYSTEM privileges. Microsoft's own threat intelligence (MSTIC) and MSRC are credited with finding it.

Microsoft scores it CVSS 3.1 7.0. The attack complexity is high only because the attacker must win a race; the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-62215) also lists low privileges and no user interaction. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62215) on November 12, 2025, with a December 3 federal deadline.

Microsoft has not said how it was used or by whom, and no one else has publicly as of Oct 23, 2026. Coverage in [The Hacker News](https://thehackernews.com/2025/11/microsoft-fixes-63-security-flaws.html) quotes Immersive's Ben McCarthy on the method: get "multiple threads to interact with a shared kernel resource in an unsynchronized way," so the kernel frees the same memory twice and corrupts its heap. Tenable's Satnam Narang assessed it was likely used after initial access gained through phishing or another bug.

## Who is affected

Windows 10 1809, 21H2 and 22H2; Windows 11 23H2, 24H2 and 25H2; and Windows Server 2019, 2022 and 2025. Server 2016 and older are not listed. Fixed builds include 26100.7171 for Windows 11 24H2 and Server 2025, 22631.6199 for Windows 11 23H2, 20348.4405 for Server 2022, 17763.8027 for Server 2019 and 19045.6575 for Windows 10 22H2.

## Do you really need to act?

For patched fleets, no. This is a second-stage bug: it turns a foothold into full control, letting an attacker disable security tools and dump credentials. It was the only zero-day in the first Patch Tuesday after [Windows 10 support ended](https://www.microsoft.com/en-us/windows/end-of-support) on October 14, 2025. The Windows 10 22H2 fix shipped only through Extended Security Updates, so unenrolled Windows 10 devices stay exploitable for good. Those devices are the real exposure today. Kernel races do get weaponized. An earlier Windows kernel race, [CVE-2024-30088](https://www.cve.org/CVERecord?id=CVE-2024-30088), is in KEV and flagged for known ransomware use.

## What to do now

1. Check builds with `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object DisplayVersion,CurrentBuild,UBR`, and install the latest cumulative update on anything below the November 2025 build.
2. Find Windows 10 22H2 devices without ESU and enroll or upgrade them.
3. Patch multi-user hosts first: Remote Desktop servers, VDI pools and shared jump hosts, where many low-privilege users run code.
4. Keep EDR on every host. It is the main control against post-compromise escalation.

## How to tell if you were hit

None of the sources above publish indicators of compromise as of Oct 23, 2026. Hunt EDR history for low-privilege processes that spawned SYSTEM processes, and for new services or drivers, on hosts that were unpatched after November 2025. Failed attempts to win a kernel race may crash the machine. Review unexplained bugchecks (System log Event ID 1001) and unexpected reboots (Event ID 41) on those hosts. Treat SYSTEM-level tampering with security tools as an incident.

## Timeline

- Oct 14, 2025 — Windows 10 support ends; later fixes for it ship only through ESU.
- Nov 11, 2025 — Microsoft fixes CVE-2025-62215 and reports exploitation.
- Nov 12, 2025 — CISA adds it to KEV.
- Dec 3, 2025 — Federal remediation deadline.

## Sources

1. [Microsoft — CVE-2025-62215 Windows Kernel Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215)
2. [CVE record — CVE-2025-62215](https://www.cve.org/CVERecord?id=CVE-2025-62215)
3. [NVD — CVE-2025-62215](https://nvd.nist.gov/vuln/detail/CVE-2025-62215)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-62215](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62215)
5. [Microsoft — Windows 10 end of support](https://www.microsoft.com/en-us/windows/end-of-support)
6. [CVE record — CVE-2024-30088](https://www.cve.org/CVERecord?id=CVE-2024-30088)
7. [The Hacker News — Microsoft Fixes 63 Security Flaws, Including a Windows Kernel Zero-Day Under Active Attack](https://thehackernews.com/2025/11/microsoft-fixes-63-security-flaws.html)

---
Source page: https://erroneo.us/security/briefs/windows-kernel-cve-2025-62215-race-condition-eop/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt