Vulnerabilities in Microsoft Products · CIAD-2025-0043
CERT-In advisory CIAD-2025-0043 · 13 Nov 2025
Official title
CIAD-2025-0043 : Multiple Vulnerabilities in Microsoft Products
Official record
Open source pageSummary
Check the official recordWhat changed
CERT-In reports multiple vulnerabilities in Microsoft products that allow attackers to gain elevated privileges, obtain sensitive information, bypass security restrictions, execute remote code, perform spoofing, or cause denial of service. Affected software includes Windows, Microsoft Office, SQL Server, Extended Security Updates, Developer Tools, Microsoft Dynamics, Open Source Software, System Center, Azure, and Nuance PowerScribe. A specific privilege escalation vulnerability in the Windows kernel, CVE-2025-62215, involves a race condition and double-free scenario. This vulnerability is currently under active exploitation. IT administrators and security teams must apply the security updates provided by Microsoft to mitigate these risks.
What you must do
- Apply the appropriate security updates as specified in the Microsoft security update guide.
Key dates
- Original Issue Date
- 13 Nov 2025
Document text
CERT-In Advisory CIAD-2025-0043
Multiple Vulnerabilities in Microsoft Products
Original Issue Date: November 13, 2025
Severity Rating: High
Software Affected
Windows
Microsoft Office
SQL Server
Extended Security Updates (ESU)
Developer Tools
Microsoft Dynamics
Open Source Software
System Center
Azure
Nuance PowerScribe
Overview
Multiple vulnerabilities have been reported in Microsoft Products which could allow an attacker to gain elevated privileges, obtain sensitive information, bypass security restrictions, conduct remote code execution attacks, perform spoofing attacks or cause denial of service conditions on the targeted system.
Target Audience:
Individuals and IT administrators, security teams responsible for maintaining and updating Microsoft products.
Risk Assessment:
Risk of remote code execution, system instability or sensitive information disclosure
Impact Assessment:
Potential compromise of system, exfiltration of data, ransomware attacks or system crashes
Description
Multiple vulnerabilities have been reported in Microsoft Products which could allow an attacker to gain elevated privileges, obtain sensitive information, bypass security restrictions, conduct remote code execution attacks, perform spoofing attacks or cause denial of service conditions on the targeted system.
A privilege escalation vulnerability ( CVE-2025-62215 ) exists in windows kernel due to concurrent execution of code that uses a shared resource without proper synchronization, resulting in a classic race condition. It also involves improper memory management, creating a double -free scenario that allows attackers to escalate privileges when successfully exploited.
Note: This vulnerability is being exploited in the wild.
For complete list of affected products, CVEs, workarounds and solutions, refer to the Microsoft security updates.
https://msrc.microsoft.com/update-guide/releaseNote/2025-Nov
Solution
Apply appropriate security updates as mentioned in:
https://msrc.microsoft.com/update-guide/releaseNote/2025-Nov
Vendor Information
Microsoft
https://msrc.microsoft.com/update-guide/releaseNote/2025-Nov
Source details
- Source
- Indian Computer Emergency Response Team
- Type
- advisory
- Published by source
- 13 Nov 2025
- Document number
- CIAD-2025-0043
- Issuing division
- CERT-In
- Coverage area
- cybersecurity