Microsoft Fixes 63 Security Flaws, Including a Windows Kernel Zero-Day Under Active Attack
Summary: Microsoft released patches for 63 new security vulnerabilities on Tuesday, four rated Critical and 59 Important, including CVE-2025-62215 (CVSS 7.0), a Windows Kernel privilege escalation race condition listed as exploited in the wild. The update also covers heap-based buffer overflow flaws in the Graphics Component (CVE-2025-60724, CVSS 9.8) and Windows Subsystem for Linux GUI (CVE-2025-62220, CVSS 8.8), plus a Windows Kerberos privilege escalation flaw (CVE-2025-60704, CVSS 7.5) that Silverfort codenamed CheckSum.
Key Takeaway: The exploited kernel bug requires an attacker to already hold a low-privilege foothold, then turns that into SYSTEM rights - and researchers note it can be chained with an RCE or sandbox escape to convert a remote attack into a full takeover. The Kerberos flaw affects any organization using Active Directory with delegation enabled, and lets an attacker impersonate arbitrary users, including becoming a domain administrator.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-60704CVE-2025-60724CVE-2025-62215CVE-2025-62220
- Related
- CVE-2025-62215: Microsoft Windows Race Condition Vulnerability Known Exploited Vulnerabilities · Nov 12, 2025