CVE-2025-62219CWE-362CWE-415

CVE-2025-62219

High · published November 11, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

⚡ A double free issue lurks in Microsoft Wireless Provisioning System, allowing a crafty attacker to level up their privileges locally! Think of it like a hotel guest who finds a way to duplicate their keycard and access restricted floors — once they’re in, they can roam freely and reach areas they shouldn’t! An attacker could exploit this vulnerability to gain elevated privileges, potentially accessing sensitive data or performing unauthorized actions within the system. The consequences could be devastating, enabling them to wreak havoc or steal important information.

Put simply

Think of it like a hotel guest who finds a way to duplicate their keycard and access restricted floors — once they’re in, they can roam freely and reach areas they shouldn’t! This vulnerability arises from a double free memory error, where the system frees the same memory location twice. This flaw allows an authorized attacker to manipulate memory usage and elevate their privileges.

What to do

An attacker could exploit this vulnerability to gain elevated privileges, potentially accessing sensitive data or performing unauthorized actions within the system. The consequences could be devastating, enabling them to wreak havoc or steal important information. To safeguard your system, ensure you apply the latest patch from Microsoft immediately. Regularly audit user permissions and monitor for any unauthorized access attempts to bolster your defenses. You've got this! With the right steps, you can shore up your defenses and keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00254 · 16.0th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-415 · Double Free
Published
2025-11-11T23:15Z
Affected products (9)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.859410.0.14393.8594
microsoft/windows_10_1607< 10.0.14393.859410.0.14393.8594
microsoft/windows_10_1809< 10.0.17763.802710.0.17763.8027
microsoft/windows_10_1809< 10.0.17763.802710.0.17763.8027
microsoft/windows_10_21h2< 10.0.19044.657510.0.19044.6575
microsoft/windows_10_22h2< 10.0.19045.657510.0.19045.6575
microsoft/windows_11_23h2< 10.0.22631.619910.0.22631.6199
microsoft/windows_11_24h2< 10.0.26100.709210.0.26100.7092
microsoft/windows_11_25h2< 10.0.26200.709210.0.26200.7092
References (1)
EPSS history
Timeline
  • 11 NOV 17:59Z
    Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability
    cvelistv5