Microsoft November 2025 Patch Tuesday fixes one exploited zero-day flaw, 63 total

Microsoft has released its November 2025 Patch Tuesday security update, patching a total of 63 vulnerabilities across multiple products and platforms. The update includes one actively exploited zero-day vulnerability in the Windows Kernel and four flaws rated as critical severity. 

The actively exploited zero-day vulnerability:

• CVE-2025-62215 (CVSS score 7.8) - Windows Kernel Elevation of Privilege Vulnerability. It's a race condition vulnerability in the Windows Kernel that attackers have already exploited in the wild to gain SYSTEM privileges on compromised Windows devices. The flaw, affects all supported versions of Windows 10, Windows 11, and Windows Server editions. An attacker with low-privilege local access can execute a specially crafted application that repeatedly attempts to trigger this race condition by getting multiple threads to interact with a shared kernel resource in an unsynchronized manner. This confuses the kernel's memory management system, causing it to free the same memory block twice. The successful double-free corrupts the kernel heap, enabling the attacker to overwrite memory and hijack the system's execution flow, ultimately obtaining SYSTEM-level privileges. The vulnerability requires some form of local execution or an account on the target host to exploit. Once a foothold is established through common attack vectors such as phishing, malicious installers, or compromised service accounts, the kernel vulnerability converts limited access into complete host compromise. 

Microsoft scored critical vulnerabilities

• CVE-2025-62199 - Microsoft Office Remote Code Execution Vulnerability
• CVE-2025-30398 - Nuance PowerScribe 360 Information Disclosure Vulnerability
• CVE-2025-62214 - Visual Studio Remote Code Execution Vulnerability
• CVE-2025-60716 - DirectX Graphics Kernel Elevation of Privilege Vulnerability

The vulnerabilities addressed in this month's update are categorized as follows:

• 29 Elevation of Privilege Vulnerabilities
• 16 Remote Code Execution Vulnerabilities
• 11 Information Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 2 Spoofing Vulnerabilities

Elevation of privilege vulnerabilities account for approximately 46% of all flaws patched this month, followed by remote code execution vulnerabilities at 25.4%. This distribution reflects a continued focus on addressing vulnerabilities that allow attackers to escalate their access rights within compromised systems and execute arbitrary code remotely.

Full patch list