Update now: November Patch Tuesday fixes Windows zero-day exploited in the wild

Malwarebytes notes that November Patch Tuesday fixes several critical Windows flaws, including ones already being exploited in the wild to gain control of systems. The update fixes CVE-2025-62215, a Windows Kernel Elevation of Privilege flaw that can be exploited via a race condition to escalate privileges after local access is gained.

It also highlights CVE-2025-60724, a heap-based buffer overflow in the GDI+ Microsoft Graphics Component with a CVSS score of 9.8, which can allow an unauthorised attacker to run malicious code over a network or when a victim opens a specially crafted document. The article describes how attackers typically chain these flaws with other methods to install malware, steal data, or achieve admin-level access, and it stresses running Windows Update, restarting, and ensuring systems are up to date.

It also outlines steps to apply the fixes via Settings and Windows Update, including checks for updates and a restart if prompted, to confirm you are up to date.