Microsoft Addresses 68 Vulnerabilities in November Patch Tuesday

Key Findings

• Microsoft released its November 2025 Patch Tuesday, addressing a total of 68 vulnerabilities, including a high-priority zero-day flaw already being actively exploited in the wild.

• The most urgent patch is for CVE-2025-62215, a Windows Kernel Elevation of Privilege Vulnerability that allows an authenticated attacker to gain SYSTEM privileges.

• In addition to the zero-day, four other flaws have been rated as Critical severity, posing a significant risk of Remote Code Execution (RCE) or high-level Elevation of Privilege (EoP).

• One notable Important-severity flaw addresses a serious information disclosure risk in Nuance PowerScribe 360.

• Microsoft also included fixes for five vulnerabilities in its Chromium-based Edge browser.

Background

The November 2025 Patch Tuesday is a critical update package that includes five critical-severity and 64 important-severity fixes across key Microsoft products such as SQL Server, Windows Hyper-V, Visual Studio, Windows Kernel, Windows WLAN Service, and more.

CVE-2025-62215: Windows Kernel Elevation of Privilege Vulnerability

• This is a zero-day vulnerability in the Windows Kernel that is already being actively exploited in the wild.

• Successful exploitation may allow an authenticated attacker to gain SYSTEM privileges.

• The attacker must win a race condition to successfully exploit this vulnerability.

Other Critical-Severity Vulnerabilities

• CVE-2025-60724 (Remote Code Execution): A heap-based buffer overflow in GDI+ (Microsoft Graphics Component) that could be exploited by an unauthenticated attacker.

• CVE-2025-62199 (Remote Code Execution): A use-after-free flaw in Microsoft Office that could allow an unauthenticated attacker to execute code locally.

• CVE-2025-60716 (Elevation of Privilege): A use-after-free vulnerability in Windows DirectX that could allow an authenticated attacker to elevate their local privileges to SYSTEM.

• CVE-2025-62214 (Remote Code Execution): A command injection vulnerability in Visual Studio that may allow an authenticated attacker to execute code locally.

Important Vulnerability: CVE-2025-30398 (Nuance PowerScribe 360 Information Disclosure)

• This vulnerability stems from missing authorization in Nuance PowerScribe, allowing an unauthenticated attacker to disclose sensitive information on the server.

Microsoft Edge Vulnerabilities

• Microsoft also included fixes for five vulnerabilities in its Chromium-based Edge browser.

Recommendation

Given the active exploitation of the Windows Kernel zero-day, IT teams must prioritize and deploy these security patches immediately to shore up their defenses against immediate threats.

Sources

• https://securityonline.info/november-patch-tuesday-microsoft-fixes-68-flaws-including-kernel-zero-day-under-active-exploitation/

• https://cyberscoop.com/microsoft-patch-tuesday-november-2025/