Roundup of Microsoft Patch Tuesday (November 2025)

Summary

On November 12 (UTC+8), 2025, Microsoft released its November 2025 Security Updates, which included patches for a total of 68 CVEs, a decrease of 115 CVEs compared to the previous month.

In terms of vulnerability severity, there were 4 vulnerabilities marked as "Critical" and 62 vulnerabilities marked as "Important/High". In terms of vulnerability types, there were primarily 21 remote code execution vulnerabilities, 29 privilege escalation vulnerabilities, and 11 information disclosure vulnerabilities.

Statistics

Vulnerability Trend

Figure 1 Vulnerabilities Patched by Microsoft in the Last 12 Months

• On the whole, Microsoft released 68 patches in November 2025, including 4 critical vulnerability patches.
• Based on Microsoft's historical vulnerability disclosures and the specific circumstances of this year, Sangfor FarSight Labs estimates that Microsoft will announce a similar number of vulnerabilities in the coming December in comparison to November. We expect a figure of approximately 70 vulnerabilities.

Comparison of Vulnerability Trends

The following figure shows the number of patches released by Microsoft in the month of November from 2022 to 2025.

Figure 2 Number of Windows Patches Released by Microsoft in November from 2022 to 2025

The following figure shows the trend and number of vulnerabilities at different severity levels addressed by Microsoft in November from 2022 to 2025.

Figure 3 Number of Vulnerabilities by Severity Level Addressed by Microsoft in November from 2022 to 2025

The following figure shows the number of vulnerabilities by type addressed by Microsoft in November from 2022 to 2025.

Figure 4 Number of Vulnerabilities by Type Addressed by Microsoft in November from 2022 to 2025

Data source: Microsoft security updates

• Compared to last year, there has been a decrease in terms of the number of vulnerabilities this year. The number of vulnerabilities addressed by Microsoft in November 2025 has decreased. A total of 68 vulnerability patches, including 4 critical ones, have been reported this month.
• Compared to last year, the number of vulnerabilities at the Critical level addressed by Microsoft remains the same, and that of vulnerabilities at the Important/High level has decreased. Specifically, 4 vulnerabilities at the Critical level have been addressed, the same as last year; and 62 vulnerabilities at the Important/High level have been addressed, a decrease of about 28.7%.
• In terms of the vulnerability type, both the number of remote code execution (RCE) vulnerabilities and the number of denial-of-service (DoS) vulnerabilities have decreased, whereas the number of elevation of privilege (EoP) vulnerabilities has increased. We should remain highly vigilant because, when combined with social engineering techniques, attackers can exploit RCE vulnerabilities to take over the entire local area network (LAN) and launch attacks.

Details of Key Vulnerabilities

Analysis

GDI+ Remote Code Execution Vulnerability (CVE-2025-60724)

The Graphics Device Interface Plus (GDI+) is a core subsystem in the Windows operating system responsible for graphics and text output. It is used to render graphic elements such as lines, rectangles, fonts, bitmaps, and icons on devices such as monitors and printers. By offering a device-independent drawing interface, GDI+ enables applications to perform drawing tasks without the need to directly operate on hardware. This ensures consistent display across different devices.

A remote code execution vulnerability exists in it, which attackers can exploit to execute arbitrary code on the target system. After assessment, it is considered that this vulnerability is critical in terms of the threat level. We recommend that users promptly update the Microsoft security patches.

Windows Kernel Elevation of Privilege Vulnerability (CVE-2025-62215)

The Windows kernel is the core component of the Windows operating system, responsible for managing the system's fundamental resources and low-level operations. Positioned between the user mode and hardware, it handles crucial tasks such as process scheduling, memory management, device drivers, file system access, security control, and interrupt handling. Its core modules include the kernel mode executive, hardware abstraction layer, and kernel object management mechanism..

An elevation of privilege vulnerability exists in it, which attackers can exploit to gain higher privileges on the target system. After assessment, it is considered that this vulnerability is critical in terms of the threat level. We recommend that users promptly update the Microsoft security patches.

Affected Versions

Solutions

Official Solution

Microsoft has released security patches for affected software. Affected users can install the corresponding security patches based on their system versions.

Download Links:

1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724
2. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215

References

https://msrc.microsoft.com/update-guide/releaseNote/2025-Nov

Timeline

On November 12, 2025, Microsoft released a security bulletin.

On November 12, 2025, Sangfor FarSight Labs released a vulnerability alert.

Learn More

Sangfor FarSight Labs researches the latest cyber threats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyber threats, providing fast and easy protection for customers.