CVE-2025-62215

HighCVSS 7.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362 CWE-415

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 12, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-622167.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-622177.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock CVE-2025-622187.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows CVE-2025-622197.0Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.CVE-2025-62229.8The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to a CVE-2025-622208.8Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network.CVE-2025-622217.8Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2025-622228.8Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an u CVE-2025-622234.3User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing CVE-2025-622243.5User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofin CVE-2025-622258.4Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write per CVE-2025-622288.8Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted ta