PT-2025-46508 · Microsoft · Windows Kernel+1

Published 2025-11-11 · Updated 2026-06-16 · CVE-2025-62215

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)

Description A race condition exists in the Windows Kernel due to improper synchronization when multiple threads concurrently access shared kernel resources. This flaw allows a local authenticated attacker with low privileges to manipulate the kernel state and perform privileged operations, resulting in an escalation to SYSTEM privileges and complete control over the affected machine. Technical analysis indicates the issue occurs in ntoskrnl.exe when the SepDuplicateToken() function prematurely releases a lock during token duplication, leading to a double free (a situation where memory is released twice) during the execution of the internal function SepMakeTokenEffectiveOnly(). This memory corruption allows the attacker to overwrite the kernel heap and hijack the system execution flow. This issue has been actively exploited in the wild.

Recommendations Apply the Microsoft November 2025 security updates to correct the synchronization logic and prevent unsafe concurrent access to kernel resources.

Exploit

Fix

DoS

RCE

LPE

Race Condition

Double Free

Weakness Enumeration

CWE-362

CWE-415

Related Identifiers

BDU:2025-14039

CVE-2025-62215

Affected Products

Windows

Windows Kernel

References · 103

• 🔥 https://exploit-db.com/exploits/52494 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-62215 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-62215 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62215 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62215 · Security Note
• https://bdu.fstec.ru/vul/2025-14039 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62215 · Security Note
• https://twitter.com/TheHackersNews/status/1988553332118736943 · Twitter Post
• https://twitter.com/cybernewslive/status/1988490974234845265 · Twitter Post
• https://t.me/S_E_Reborn/6022 · Telegram Post
• https://twitter.com/dailytechonx/status/1988669386098450621 · Twitter Post
• https://twitter.com/RIPS73R/status/1993771264373039184 · Twitter Post
• https://twitter.com/lowcountrycyber/status/1990831400539259300 · Twitter Post
• https://twitter.com/1author_drbaker/status/1991196045976465445 · Twitter Post