CVE-2025-62215: Windows Kernel race condition and double free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows local privilege escalation to SYSTEM and is listed in CISA KEV as exploited, though it requires local access and low privileges rather than being remotely reachable.

What it is

A race condition combined with a double free in the Windows Kernel lets a locally authenticated attacker corrupt kernel memory and elevate privileges. Because the flaw sits in the kernel, successful exploitation yields full control of the affected host. It affects a broad set of Windows 10, Windows 11 and Windows Server releases.

Impact

An attacker who already holds a low-privileged account can escalate to SYSTEM-level privileges on the machine. That level of access enables disabling security controls, dumping credentials and moving laterally.

Attack surface

Reached locally through the kernel attack surface; the CVSS vector shows local access (AV:L), low privileges required (PR:L) and no user interaction (UI:N). No remote or network path is described.

Exploitation

CVE-2025-62215 was added to CISA KEV on 2025-11-12 with a remediation due date of 2025-12-03, indicating known exploitation in the wild. EPSS 30-day probability is about 6.0 percent (92.9th percentile), and CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft security update for CVE-2025-62215 to all affected Windows 10, Windows 11 and Windows Server builds as the first action.
• Prioritize internet-facing and high-value hosts, and meet the CISA KEV due date of 2025-12-03.
• Restrict and monitor local interactive logon and low-privileged account use on sensitive systems to reduce the pool of accounts that can trigger the flaw.
• If patching cannot be completed immediately, follow vendor mitigation guidance or isolate affected systems per BOD 22-01.
• Verify patch deployment with vulnerability scanning and confirm kernel build versions across the estate.

Detection

• Monitor for unexpected SYSTEM-level process creation or token elevation originating from low-privileged user sessions.
• Alert on kernel crash or bugcheck events that may indicate race-condition or double-free exploitation attempts.
• Correlate local logon events with subsequent privileged process activity on the same host.
• Track patch compliance for the affected Windows builds and flag unpatched endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.