Microsoft Patch Tuesday for November 2025

CVE-2025-62199Microsoft OfficeUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-60716DirectX Graphics KernelUse after free in Windows DirectX allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60724GDI+Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.Remote Code ExecutionCVE-2025-62214Visual StudioImproper neutralization of special elements used in a command (‘command injection’) in Visual Studio allows an authorized attacker to execute code locally.Remote Code ExecutionCVE-2025-30398Nuance PowerScribe 360Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network.Information DisclosureCVE-2025-59504Azure Monitor AgentHeap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-59505Windows Smart Card ReaderDouble free in Windows Smart Card allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-59506DirectX Graphics KernelConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows DirectX allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-59507Windows Speech RuntimeConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Speech allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-59508Windows Speech RecognitionConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Speech allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-59509Windows Speech RecognitionInsertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally.Information DisclosureCVE-2025-59510Windows Routing and Remote Access Service (RRAS)Improper link resolution before file access (‘link following’) in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.Denial of ServiceCVE-2025-59511Windows WLAN ServiceExternal control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-59512Customer Experience Improvement Program (CEIP)Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-59513Windows Bluetooth RFCOM Protocol DriverOut-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally.Information DisclosureCVE-2025-60703Windows Remote Desktop ServicesUntrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60704Windows KerberosMissing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.Elevation of PrivilegeCVE-2025-60705Windows Client-Side CachingImproper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60706Windows Hyper-VOut-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.Information DisclosureCVE-2025-60707Multimedia Class Scheduler Service (MMCSS) DriverUse after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60708Storvsp.sys DriverUntrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.Denial of ServiceCVE-2025-60709Windows Common Log File System DriverOut-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60710Host Process for Windows TasksImproper link resolution before file access (‘link following’) in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60726Microsoft ExcelOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.Information DisclosureCVE-2025-60727Microsoft ExcelOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-60728Microsoft ExcelUntrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.Information DisclosureCVE-2025-62206Microsoft Dynamics 365 (On-Premises)Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.Information DisclosureCVE-2025-62210Dynamics 365 Field Service (online)Improper neutralization of input during web page generation (‘cross-site scripting’) in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.SpoofingCVE-2025-62216Microsoft OfficeUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-60719Windows Ancillary Function Driver for WinSockUntrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60722Microsoft OneDrive for AndroidImproper limitation of a pathname to a restricted directory (‘path traversal’) in OneDrive for Android allows an authorized attacker to elevate privileges over a network.Elevation of PrivilegeCVE-2025-62217Windows Ancillary Function Driver for WinSockConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-62218Microsoft Wireless Provisioning SystemConcurrent execution using shared resource with improper synchronization (‘race condition’) in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-62219Microsoft Wireless Provisioning SystemDouble free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-62220Windows Subsystem for Linux GUIHeap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network.Remote Code ExecutionCVE-2025-62452Windows Routing and Remote Access Service (RRAS)Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.Remote Code ExecutionCVE-2025-59240Microsoft ExcelExposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.Information DisclosureCVE-2025-47179Configuration ManagerImproper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-59514Microsoft Streaming Service ProxyImproper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-59515Windows Broadcast DVR User ServiceUse after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60713Windows Routing and Remote Access Service (RRAS)Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60714Windows OLEHeap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-60715Windows Routing and Remote Access Service (RRAS)Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.Remote Code ExecutionCVE-2025-60717Windows Broadcast DVR User ServiceUse after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60718Windows Administrator ProtectionUntrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60720Windows Transport Driver Interface (TDI) Translation DriverBuffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-60723DirectX Graphics KernelConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows DirectX allows an authorized attacker to deny service over a network.Denial of ServiceCVE-2025-62200Microsoft ExcelUntrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-62201Microsoft ExcelHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-62202Microsoft ExcelOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.Information DisclosureCVE-2025-62203Microsoft ExcelUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-62204Microsoft SharePointDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Remote Code ExecutionCVE-2025-62205Microsoft OfficeUse after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.Remote Code ExecutionCVE-2025-62208Windows License ManagerInsertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.Information DisclosureCVE-2025-62209Windows License ManagerInsertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.Information DisclosureCVE-2025-59499Microsoft SQL ServerImproper neutralization of special elements used in an sql command (‘sql injection’) in SQL Server allows an authorized attacker to elevate privileges over a network.Elevation of PrivilegeCVE-2025-62211Dynamics 365 Field Service (online)Improper neutralization of input during web page generation (‘cross-site scripting’) in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.SpoofingCVE-2025-62215Windows KernelConcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Kernel allows an authorized attacker to elevate privileges locally. (Zero-day, exploited)Elevation of PrivilegeCVE-2025-62213Windows Ancillary Function Driver for WinSockUse after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-62222Agentic AI and Visual Studio CodeImproper neutralization of special elements used in a command (‘command injection’) in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network.Remote Code ExecutionCVE-2025-62449Microsoft Visual Studio Code CoPilot Chat ExtensionImproper limitation of a pathname to a restricted directory (‘path traversal’) in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally.Security Feature BypassCVE-2025-60721Windows Administrator ProtectionPrivilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.Elevation of PrivilegeCVE-2025-62453GitHub Copilot and Visual Studio CodeImproper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.Security Feature Bypass