Microsoft November 2025 Patch Tuesday – 63 Vulnerabilities, Including 1 Zero-Day Fixed

Microsoft rolled out its November 2025 Patch Tuesday security updates today, addressing 63 vulnerabilities across its product and service ecosystem.

Among these, one zero-day flaw has already been exploited in the wild, underscoring the urgency for organizations and users to apply patches promptly to mitigate potential threats.

The updates cover Windows, Office, Azure, Visual Studio, and other components, with a focus on remote code execution (RCE) and elevation of privilege (EoP) issues that could allow attackers to compromise systems.

ImpactCountElevation of Privilege29​ The key concern is CVE-2025-62215, a Windows Kernel Elevation of Privilege vulnerability rated as Important, with confirmed exploitation.

This race condition flaw enables an authorized local attacker to escalate privileges by exploiting improper synchronization in shared resources.

Microsoft notes that exploitation is more likely due to its active use, potentially allowing threat actors to gain higher access on affected Windows systems. No workaround exists beyond installing the update, and experts recommend immediate deployment on all supported versions, including Windows 10, 11, and Server editions.

Critical vulnerabilities dominate the release, with five rated as such. Leading the pack is CVE-2025-62199, a use-after-free bug in Microsoft Office leading to RCE, where an unauthorized attacker could execute code locally via malicious documents.

Exploitation is deemed less likely, but its critical severity warrants priority patching for Office users. Similarly, CVE-2025-60716 in Windows DirectX involves a use-after-free error, allowing local privilege escalation to critical levels.

Another high-impact issue, CVE-2025-60724, is a heap-based buffer overflow in GDI+ that permits remote code execution over networks, posing risks to graphics-dependent applications.

CVE-2025-62214 affects Visual Studio with command injection for local RCE, while CVE-2025-30398 in Nuance PowerScribe 360 exposes sensitive information via missing authorization, all released on November 11, 2025.

The bulk of the patches, 57, rated Important target elevation of privilege flaws, which comprised over half the vulnerabilities. Notable examples include CVE-2025-59505 (double free in Windows Smart Card), CVE-2025-60704 (missing crypto in Kerberos for network-based EoP), and CVE-2025-60719 (untrusted pointer in WinSock driver).

Information disclosure issues, like CVE-2025-59509 in Windows Speech Recognition, and denial-of-service bugs, such as CVE-2025-59510 in RRAS, round out the list.

Azure components aren’t spared, with CVE-2025-59504 offering local RCE in the Monitor Agent via buffer overflow. Dynamics 365 sees spoofing via XSS in CVE-2025-62210 and CVE-2025-62211.

CVE IDProduct/ComponentDescriptionImpactout-of-bounds read in the Windows Bluetooth RFCOMM Protocol Driver allows an authorized attacker to disclose local information.Information Disclosurereflects Microsoft’s ongoing efforts to bolster defenses amid rising threat landscapes, including APT campaigns targeting enterprise software. Affected products span client OS, servers, productivity tools, and cloud services, emphasizing the need for comprehensive patch management. Security teams should scan environments using tools like Microsoft Update or WSUS, prioritizing internet-facing and privileged systems. Vulnerability researchers highlight that while no additional zero-days were publicly disclosed, the exploited CVE-2025-62215 aligns with trends in kernel-level attacks. Other Patch Tuesday Vulnerabilities Firefox Releases Security Update to Fix Multiple Vulnerabilities Allowing Arbitrary Code Execution Ivanti Endpoint Manager Vulnerabilities Let Attackers Write Arbitrary Files to Disk Synology BeeStation 0-Day Vulnerability Let Remote Attackers Execute Arbitrary Code SAP Security Update – Patch for Critical Vulnerabilities Allowing Code Execution and Injection Attacks Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

Based on reporting by Cyber Security News.