Windows Kernel 0-Day Under Active Exploitation for Privilege Escalation

Microsoft has disclosed a critical Windows Kernel vulnerability, tracked as CVE-2025-62215, that is under active exploitation in the wild. The flaw is an elevation-of-privilege issue in the Windows Kernel arising from improper synchronization when multiple processes access shared resources, allowing local attackers to execute arbitrary code with system-level permissions. It was released on 11 November 2025 and carries a CVSS score of 7.0 (7.0 in the Microsoft assessment, with 6.5 alternative).

The vulnerability requires local access and can be exploited without user interaction by triggering a race condition in the kernel’s memory management subsystem to cause a double-free and memory corruption. According to security researchers monitoring threat activity, this vulnerability is being actively exploited by multiple threat actors in targeted attacks, with breaches aimed at data theft, ransomware deployment, and backdoor establishment.

Microsoft has released security patches and organisations are urged to apply the latest Windows updates and implement defensive measures such as restricting local account creation, turning off unnecessary services, and deploying EDR solutions.