CVE-2025-62215
- EPSS 0.59%
- Veröffentlicht 11.11.2025 18:15:48
- Zuletzt bearbeitet 14.11.2025 02:00:02
- Quelle secure@microsoft.com
- CVE-Watchlists
- Unerledigt
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
Login12.11.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog
Microsoft Windows Race Condition Vulnerability
SchwachstelleMicrosoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.
BeschreibungApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Erforderliche Maßnahmen| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.59% | 0.686 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| secure@microsoft.com | 7 | 1 | 5.9 |
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
|
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.