Microsoft Patch Tuesday, November 2025 Edition
Summary: Microsoft's November 2025 Patch Tuesday fixed more than 60 vulnerabilities across Windows, Office, SharePoint, SQL Server, Visual Studio, GitHub Copilot, and Azure Monitor Agent, including a zero-day memory corruption bug, CVE-2025-62215, that is already being exploited. Microsoft also released an out-of-band update, KB5071959, to fix enrollment problems in the Windows 10 Consumer Extended Security Update program, and rated CVE-2025-62215 'important' rather than critical because exploitation requires prior access to the target device.
Bottom line: CVE-2025-60274 is a 9.8-rated flaw in GDI+, a graphics component used by Office, image-processing web servers, and countless third-party applications, and Immersive's Ben McCarthy calls its patch an organization's highest priority even though Microsoft assesses exploitation as less likely.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-60274CVE-2025-62199CVE-2025-62215
- Related
- CVE-2025-62215: Microsoft Windows Race Condition Vulnerability Known Exploited Vulnerabilities · Nov 12, 2025