CVE-2025-64658

HighCVSS 7.5/10Last modified Sep 25, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2025
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-64669.8A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscripCVE-2025-646608.0Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.CVE-2025-646617.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker tCVE-2025-646638.8Custom Question Answering Elevation of Privilege VulnerabilityCVE-2025-646667.5Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2025-646675.3User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofiCVE-2025-646697.8Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.CVE-2025-64679.8A vulnerability was found in code-projects Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of thCVE-2025-646706.5Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose informaCVE-2025-646717.8Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute coCVE-2025-646729.0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2025-646737.8Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.