Monthly Fallout Report
November 2025 Fallout
63 vulnerabilities, one Windows Kernel zero-day exploited in the wild, laptop sleep-to-freeze chaos, and the first Patch Tuesday where Windows 10 only gets updates if you're paying for ESU.
Tired of patch chaos? Automox automates patching across Windows, Mac, and Linux — so you're never caught off guard on Patch Tuesday.
Try Free →Fallout Timeline
A quieter month by the numbers — 63 vulnerabilities versus October’s 172 — but quality over quantity. The headline is CVE-2025-62215, an actively exploited Windows Kernel EoP that lets attackers win a race condition to reach SYSTEM. No user interaction required, exploitation confirmed before the patch dropped. The CVSS 9.8 Graphics Component flaw CVE-2025-60724 allows unauthenticated RCE via a crafted image file — no user needs to open anything. Microsoft Office gets three RCE patches; CVE-2025-62199 is the scary one: the Outlook Preview Pane is an attack vector. Three WinSock driver flaws (CVE-2025-60719, 62213, 62217) are all marked “Exploitation More Likely.” VS Code Copilot Chat Extension gets an RCE fix (CVE-2025-62222) — the AI tooling attack surface keeps expanding. November is also the first ESU Patch Tuesday for Windows 10, meaning you’re now paying for the privilege of staying patched.
Windows Kernel EoP — race condition and double-free allow local authenticated attacker to reach SYSTEM. No user interaction required. PoC published November 20. Update immediately.
Windows Graphics Component (GDI+) RCE — heap buffer overflow via crafted image file processed by vulnerable services. Unauthenticated, no user interaction required. Highest severity this month.
Microsoft Office RCE — the Outlook Preview Pane is an attack vector. Scrolling past a malicious email is enough to trigger code execution. No need to open the file.
SQL Server RCE via crafted query — authenticated attacker can execute code remotely through a malicious SQL query. Affects SQL Server 2016 through 2022. Patch SQL Server instances before the December holidays.
VS Code Copilot Chat Extension RCE — untrusted input in the AI assistant enables local code execution. Another data point in the expanding AI tooling attack surface.
Sources: BleepingComputer · Tenable · Neowin
November’s update is operationally quieter than October’s dev catastrophe — but not silent. The most-reported issue: KB5068861 is causing laptops to freeze when waking from sleep, observed across Intel x64, AMD x64, and Qualcomm Snapdragon X (ARM64) devices. Multiple IT admins managing large fleets paused deployment across all tenants. ASUS ROG Ally X gamers hit install failures with errors 0x80071ab0 and 0x800f0991. Otherwise the update is clean — no major developer regressions, no localhost apocalypses., developers across Windows 11 24H2 and 25H2 discovered that localhost (127.0.0.1) was completely broken. Browser connections returned ERR_HTTP2_PROTOCOL_ERROR or ERR_CONNECTION_RESET. Visual Studio couldn't attach to IIS Express. The Duo Desktop authentication app stopped working. Autodesk Vault users couldn't connect to local servers. Root cause: a regression in HTTP.sys (the kernel-mode HTTP driver) that terminates HTTP/2 sessions on the loopback interface during handshake. A secondary regression broke WinRE — keyboards and mice stopped working in the Windows Recovery Environment, meaning if you needed to recover a broken PC, your input devices wouldn't work. Microsoft acknowledged the HTTP.sys issue on October 17 and deployed a Known Issue Rollback (KIR). Registry workaround: add EnableHttp2Tls and EnableHttp2Cleartext = 0 under HKLM\System\CurrentControlSet\Services\HTTP\Parameters.
- Windows 11 (laptops) KB5068861 causes sleep/wake freezes — Intel, AMD, Snapdragon X affected. Fleet admins pausing deployment across tenants HTTP/2
- ROG Ally X KB5068861 install failures — errors 0x80071ab0 and 0x800f0991. Use Update Catalog for manual install
- Windows 11 (all) Microsoft KB page shows no known issues — gap between official stance and community reports
Sources: r/sysadmin · HTMD Blog · AskWoody
November turned out to be one of the cleaner months operationally. Sleep/wake freeze reports settled — the issue was limited to specific hardware configurations, not widespread enough for Microsoft to issue a formal known issue acknowledgement. No OOB updates were needed. The PoC for CVE-2025-62215 published November 20 generated attention but no new confirmed exploitation beyond the original zero-day usage. to consumer devices via Windows Update silently — many users found it fixed on reboot without a manual update. Enterprise admins needed to deploy a specific Group Policy KIR package. The WSUS RCE (CVE-2025-59287) was confirmed exploited in the wild by October 24, Microsoft issued an out-of-band update with a more comprehensive fix. WinRE keyboard/mouse fix arrived via a separate OOB update (KB5070773). Windows 10 end-of-support left a long tail: organizations discovering devices not enrolled in ESU, facing a hard choice between paying Microsoft for extended support or facing zero future patches.
- Windows 11 (laptops) Sleep/wake freeze reports subsided — isolated to specific hardware+driver combos
- All platforms CVE-2025-62215 PoC published November 20 — update immediately if not already patched
- Windows 10 ESU First ESU patch cycle completed without major issues for enrolled organizations
Sources: BleepingComputer · AskWoody
Resources