{"id":131087,"date":"2025-11-12T10:28:20","date_gmt":"2025-11-12T10:28:20","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/131087\/"},"modified":"2025-11-12T10:28:20","modified_gmt":"2025-11-12T10:28:20","slug":"microsoft-fixes-windows-kernel-zero-day-in-november-patch-tuesday","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/131087\/","title":{"rendered":"Microsoft Fixes Windows Kernel Zero Day in November Patch Tuesday"},"content":{"rendered":"

Microsoft issued security updates to fix over 60 CVEs in the November Patch Tuesday yesterday, including one being actively exploited in the wild.<\/p>\n

No public proof-of-concept has been released for CVE-2025-62215, although it is being used by threat actors, according to Mike Walters, president and co-founder of Action1.<\/p>\n

\u201cThis race-condition and double-free flaw enables a locally accessible, low-privileged attacker to corrupt kernel memory and escalate to system privileges,\u201d he explained.<\/p>\n

\u201cThe attack requires local code execution or local access and successful timing of a race, which is complex and fragile and typically needs pool grooming and concurrent threads. The attacker only needs low privileges and no other user interaction.\u201d<\/p>\n

When chained with other vulnerabilities, the CVE becomes a\u00a0critical threat,\u00a0potentially enabling server compromise, mass credential exposure, lateral movement and ransomware deployment.<\/p>\n

\u201cA remote code execution or sandbox escape can supply the local code execution needed to turn a remote attack into a system takeover, and an initial low\u2011privilege foothold can be escalated to dump credentials and move laterally,\u201d warned Walters.<\/p>\n

Read more on Patch Tuesday: Last Windows 10 Patch Tuesday Features Six Zero-Days<\/a><\/p>\n

Elsewhere this month, there were 29 elevation of privilege (EoP) vulnerabilities, 16 remote code execution (RCE) and two security feature bypass bugs fixed by Microsoft.<\/p>\n

Of the four critical vulnerabilities in this Patch Tuesday, two are RCE, one is EoP and the fourth is an information disclosure flaw.<\/p>\n

Ben McCarthy, lead cybersecurity engineer at Immersive, urged sysadmins to patch critical RCE bug CVE-2025-60724, which has a CVSS score of 9.8. It impacts the GDI+ (Graphics Device Interface) library \u2013 a core Windows component used for rendering 2D graphics, images and text.<\/p>\n

\u201cWith this vulnerability, when the server-side application automatically parses a specially crafted metafile, the vulnerable GDI+ library is called. This triggers the heap overflow, allowing the attacker to corrupt memory and gain RCE on the server,\u201d said McCarthy.\u00a0<\/p>\n

\u201cThe patch for this should be an organization\u2019s highest priority. Given that this vulnerability can be triggered by simply uploading a file to a public-facing web application, any system that processes user-supplied documents is at risk.\u201d<\/p>\n

Teething Troubles For Extended Security Updates<\/p>\n

This was the first Patch Tuesday since Windows 10 reached end of life, meaning that only individuals or organizations subscribed to Extended Security Updates (ESU) can still receive patches for the legacy OS.<\/p>\n

However, Microsoft was forced to issue a new out-of-band update (KB5071959) yesterday after some users were unable to enroll in the program.<\/p>\n

\u201cThis update addresses an issue in the Windows 10 Consumer Extended Security Update (ESU) enrollment process, where the enrollment wizard may fail during enrollment,\u201d Microsoft said.<\/p>\n

\u201cAfter applying this update, consumer devices should be able to successfully enroll in ESU using the ESU wizard.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"Microsoft issued security updates to fix over 60 CVEs in the November Patch Tuesday yesterday, including one being…\n","protected":false},"author":2,"featured_media":131088,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[111,139,69,145],"class_list":["post-131087","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-new-zealand","tag-newzealand","tag-nz","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/131087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=131087"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/131087\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/131088"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=131087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=131087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=131087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}