Patch Tuesday Summary November 2025

Headlines

Microsoft issued patches for 63 CVE-rated vulnerabilities.

One actively exploited zero-day vulnerability

Five Critical vulnerabilities

First Extended Security Update (ESU) release for Windows 10

29 Elevation of Privilege vulnerabilities

16 Remote Code Execution vulnerabilities

11 Information Disclosure vulnerabilities

3 Denial of Service vulnerabilities

2 Security Feature Bypass vulnerabilities

2 Spoofing vulnerabilities

Quorum Cyber Recommendations

Patching should be carried out within normal maintenance cycles, but systems affected by CVE-2025-62215 (Windows Kernel EoP) should be prioritised for near-term deployment due to confirmed exploitation in the wild. At present, we do not recommend emergency patching outside established processes.

Microsoft Release Notes

November 2025 Security Updates – Release Notes – Security Update Guide – Microsoft

Overview

Microsoft released its November 2025 Patch Tuesday updates, addressing 63 vulnerabilities across Windows, Office, Azure, Visual Studio and related components. The release includes five Critical vulnerabilities and one actively exploited zero-day, underscoring the need for prompt patch management.

The confirmed zero-day is CVE-2025-62215, a Windows Kernel race-condition that enables local privilege escalation to SYSTEM. Microsoft’s Threat Intelligence teams (MSTIC/MSRC) have been credited with discovery and reporting; exploitation appears to be used as a post-compromise escalation technique rather than an initial remote access vector.

It is worth noting that Microsoft classifies vulnerabilities as Critical, Important, Moderate or Low based on impact and exploitability rather than CVSS alone. CVSS scores are provided separately for reference and do not determine Microsoft’s severity category.

Vulnerability Overview

Total vulnerabilities: 63

Actively exploited zero-days: 1 (CVE-2025-62215 – Windows Kernel EoP)

Critical vulnerabilities: 5, including remote code execution in GDI+, Office, and Visual Studio components

Important vulnerabilities: 58, most involving local privilege escalation and information disclosure

Notable Fixes

CVE-2025-62215: Windows Kernel race condition enabling SYSTEM privilege escalation (actively exploited).

CVE-2025-60724: Heap-based buffer overflow in GDI+ permitting remote code execution (CVSS 9.8).

CVE-2025-62220: Heap overflow in Windows Subsystem for Linux GUI (CVSS 8.8).

CVE-2025-60704: Kerberos (CheckSum) privilege escalation flaw in constrained delegation logic (CVSS 7.5).

CVE-2025-62199: Use-after-free in Microsoft Office enabling remote code execution (CVSS 7.8).

Windows 10 Extended Security Updates (ESU)

This release marks the first ESU patch cycle for Windows 10 following end-of-support in October 2025. Organisations continuing to run Windows 10 must enrol in the ESU programme or migrate to Windows 11 to maintain patch coverage.

Key Takeaways for IT Teams

Prioritise updates addressing CVE-2025-62215, given confirmed in-the-wild exploitation.

Review and patch systems using GDI+, Office, and Kerberos components due to potential RCE and EoP risks.

Ensure Windows 10 devices are covered by ESU or have migration timelines in place.

Maintain updated EDR, IDS/IPS and Snort signatures to detect attempted exploitation of recent CVEs.

Affected Products

Patches span across:
- Windows OS (10, 11, Server editions)
- Microsoft Office
- Azure services
- Third-party drivers bundled with Windows

Key Takeaways for IT Admins

Prioritise patching systems vulnerable to the actively exploited zero-days
Review systems for legacy components like the Agere Modem driver
Plan migration strategies for Windows 10 systems or enroll in ESU programs

Key Vulnerability Details

Title	Windows Kernel Elevation of Privilege Vulnerability
CVE	CVE-2025-62215
CVSS	7.0
Reason for Concern	This vulnerability is an actively exploited zero-day in the Windows Kernel caused by improper synchronisation during concurrent access to shared resources. A local attacker with limited privileges can exploit a race condition to escalate privileges to SYSTEM. Exploitation requires local access but has already been observed in the wild, typically as part of post-exploitation activity following phishing or RCE intrusion.
Mitigations and other factors	No workarounds or configuration mitigations are available. Microsoft has released patches for all supported Windows versions, including Windows 10, 11, and Server editions. Applying the update is the only effective remediation.
Commentary	CVE-2025-62215 is a realistic post-compromise escalation technique rather than an initial access vector. It is being leveraged to maintain persistence and move laterally after attackers gain a foothold.
Threat Intelligence Comment	It is likely that exploitation of CVE-2025-62215 will continue over the coming weeks, given its confirmed use in the wild and the low attack complexity. Elevation-of-privilege flaws remain attractive to both ransomware operators and nation-state groups seeking persistence and lateral movement within compromised environments.
Link	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215

Title	Microsoft GDI+ Remote Code Execution Vulnerability
CVE	CVE-2025-60724
CVSS	9.8
Reason for Concern	A heap-based buffer overflow in the Microsoft Graphics Component (GDI+) could allow an unauthenticated attacker to execute arbitrary code by convincing a user or service to process a malicious metafile. In some cases, exploitation may occur server-side where web applications automatically parse uploaded documents containing crafted metafiles.
Mitigations and other factors	Microsoft has released patches to address this vulnerability across supported Windows and Office installations. Users should exercise caution when opening unsolicited image or document files and ensure file upload filtering on web servers is enabled.
Commentary	This vulnerability has broad potential impact, particularly for document-handling and web-based environments. While Microsoft rates exploitation as “less likely,” its network exposure and high CVSS score warrant close attention.
Threat Intelligence Comment	I f weaponised, CVE-2025-60724 could become an effective vector for initial compromise in spear-phishing or web-exposed service attacks. Threat actors have previously exploited GDI+ flaws in similar ways.
Link	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724

Title	DirectX Graphics Kernel Elevation of Privilege Vulnerability
CVE	CVE-2025-60716
CVSS	7.0
Reason for Concern	A use-after-free flaw in the DirectX Graphics Kernel permits an attacker with local access to escalate privileges by winning a race condition in memory management.
Mitigations and other factors	Exploitation requires prior access to the system. Microsoft has corrected memory handling in the November update. No workarounds exist.
Commentary	This flaw could enable attackers to move from low-privilege access to full SYSTEM control, particularly when chained with client-side RCE vulnerabilities.
Threat Intelligence Comment	Elevation-of-privilege vulnerabilities in DirectX have historically been exploited in gaming and driver-level intrusion scenarios. Although assessed “less likely”, its potential use in post-compromise privilege escalation makes patching a priority.
Link	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60716

Title	Microsoft Office Remote Code Execution Vulnerability
CVE	CVE-2025-62199
CVSS	7.8
Reason for Concern	A use-after-free vulnerability in Microsoft Office allows code execution when a user opens a malicious file. The flaw can be exploited locally through phishing emails or drive-by document downloads.
Mitigations and other factors	Microsoft patched all supported Office versions. Organisations should enforce Protected View and avoid disabling macro or ActiveX protections.
Commentary	While marked “less likely” for exploitation, Office vulnerabilities remain one of the most common infection vectors.
Threat Intelligence Comment	Quorum Cyber assesses this vulnerability as an attractive target for threat actors conducting phishing operations, given Office’s ubiquity and the ease of social engineering delivery.
Link	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62199

Title	Visual Studio Remote Code Execution Vulnerability
CVE	CVE-2025-62214
CVSS	6.7
Reason for Concern	A command-injection vulnerability in Visual Studio could permit local code execution when manipulated prompt input interacts with AI Copilot functions and triggers a build.
Mitigations and other factors	Multiple user interactions are required for successful exploitation. Microsoft has fixed input-validation logic within the affected components.
Commentary	This issue underscores emerging risks in AI-assisted development environments. Though exploitation is “less likely”, its complexity does not negate potential insider or supply-chain scenarios.
Threat Intelligence Comment	CVE-2025-62214 broadens the attack surface within development ecosystems. It is plausible that researchers and threat actors will explore related injection paths in future.
Link	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62214

Title	Nuance PowerScribe 360 Information Disclosure Vulnerability
CVE	CVE-2025-30398
CVSS	8.1
Reason for Concern	Missing authorisation controls within Nuance PowerScribe 360 allow unauthenticated attackers to make API calls that expose sensitive data, including personally identifiable information (PII), over a network.
Mitigations and other factors	The November update corrects the authentication logic. Organisations using PowerScribe 360 should review access logs for suspicious API activity and confirm that systems are updated.
Commentary	Although not an RCE, Microsoft classified this issue as Critical due to the potential exposure of confidential medical or clinical data.
Threat Intelligence Comment	Information disclosure vulnerabilities of this nature are often exploited for data harvesting or extortion. Healthcare and diagnostic networks using PowerScribe 360 should patch urgently and validate API authentication controls.
Link	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30398

Threat Intelligence