CVE-2025-60724

—

CVSS 3.1

9.8 critical

EPSS

6%p93

Published

Nov 11, 2025 (Nov 11, 2025)

Modified

Jun 17, 2026

Description

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Vendors: microsoft
Products: 365 copilot, office long term servicing channel, windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 23h2, windows 11 24h2, windows 11 25h2, windows server 2008, windows server 2012, windows server 2016
Weakness: CWE-122
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.9%)

In the news5 stories

Microsoft Fixes 63 Security Flaws, Including a Windows Kernel Zero

The Hacker NewsNov 12, 11:14 UTC · Nov 12, 2025Exploit / PoC in the wildCVE-2025-62215 CVE-2025-60724 CVE-2025-62220+1 CVEs

60

Microsoft Fixes Windows Kernel Zero Day in November Patch Tuesday

Infosecurity MagazineNov 12, 10:15 UTC · Nov 12, 2025Vulnerability in the wildCVE-2025-62215 CVE-2025-60724

60

Patch Tuesday: Microsoft fixes actively exploited Windows kernel vulnerability (CVE-2025-62215)

Help Net SecurityNov 12, 00:00 UTC · Nov 12, 2025Vulnerability in the wildCVE-2025-62215 CVE-2025-60724 CVE-2025-62199+1 CVEs

60

Microsoft Patch Tuesday addresses 63 defects, including one actively exploited zero

CyberScoopNov 11, 20:49 UTC · Nov 11, 2025Vulnerability in the wildCVE-2025-62215 CVE-2025-60724 CVE-2025-60719+2 CVEs

60

Microsoft Patch Tuesday for November 2025 — Snort rules and prominent vulnerabilities

Cisco TalosNov 11, 18:19 UTC · Nov 11, 2025Vulnerability in the wildCVE-2025-62215 CVE-2025-60724 CVE-2025-60719+2 CVEs

60