CVE-2025-64661

HighCVSS 7.8/10Last modified Sep 25, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2025
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-646638.8Custom Question Answering Elevation of Privilege VulnerabilityCVE-2025-646667.5Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2025-646675.3User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofiCVE-2025-646697.8Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.CVE-2025-64679.8A vulnerability was found in code-projects Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of thCVE-2025-646706.5Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose informaCVE-2025-646717.8Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute coCVE-2025-646729.0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2025-646737.8Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.CVE-2025-646759.6Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to pCVE-2025-646767.2'.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network.CVE-2025-646778.2Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized
CVE-2025-64661: High severity, CVSS 7.8 | Vulnix