CVE-2025-62573: DirectX Graphics Kernel Elevation of Privilege Vulnerability

CVE-2025-62573 is an elevation of privilege vulnerability in DirectX Graphics Kernel, rated Important by Microsoft, with a CVSS 3.1 base score of 7 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.26% probability of exploitation activity in the next 30 days, higher than 19% of all scored vulnerabilities. Microsoft released the fix on 8 December 2025 in the December 2025 Patch Tuesday, delivered through 9 security updates (KB5071544, KB5071547, KB5071413, KB5071546 and more). It affects 25 products in 2 product families (Windows, ESU).

Key facts

CVE ID: CVE-2025-62573
Severity: High CVSS 7
Microsoft severity: Important
Impact: Elevation of Privilege
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-362; CWE-416
EPSS: 0.26% (percentile 19%)
CISA KEV: Not listed
Released: 8 December 2025
Last updated: 8 December 2025
Patch Tuesday: December 2025 Patch Tuesday
Product families: Windows, ESU

CVSS score and vector

Microsoft scores CVE-2025-62573 at 7 (temporal 6.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Metric	Value
Attack vector	Local
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.

Frequently asked questions (Microsoft)

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (25)

Windows

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1809 for 32-bit Systems	KB5071544	Security Update	10.0.17763.8146	Yes
Windows 10 Version 1809 for x64-based Systems	KB5071544	Security Update	10.0.17763.8146	Yes
Windows Server 2019	KB5071544	Security Update	10.0.17763.8146	Yes
Windows Server 2019 (Server Core installation)	KB5071544	Security Update	10.0.17763.8146	Yes
Windows Server 2022	KB5071547 KB5071413	Security Update Security Hotpatch Update	10.0.20348.4529 10.0.20348.4467	Yes Yes
Windows Server 2022 (Server Core installation)	KB5071547 KB5071413	Security Update Security Hotpatch Update	10.0.20348.4529 10.0.20348.4467	Yes Yes
Windows 10 Version 21H2 for 32-bit Systems	KB5071546	Security Update	10.0.19044.6691	Yes
Windows 10 Version 21H2 for ARM64-based Systems	KB5071546	Security Update	10.0.19044.6691	Yes
Windows 10 Version 21H2 for x64-based Systems	KB5071546	Security Update	10.0.19044.6691	Yes
Windows Server 2025 (Server Core installation)	KB5072033 KB5072014	Security Update Security Hotpatch Update	10.0.26100.7462 10.0.26100.7392	Yes Yes
Windows 11 Version 25H2 for ARM64-based Systems
Windows 11 Version 25H2 for x64-based Systems
Windows 11 Version 23H2 for ARM64-based Systems	KB5071417	Security Update	10.0.22631.6345	Yes
Windows 11 Version 23H2 for x64-based Systems	KB5071417	Security Update	10.0.22631.6345	Yes
Windows Server 2022, 23H2 Edition (Server Core installation)	KB5071542	Security Update	10.0.25398.2025	Yes
Windows 11 Version 24H2 for ARM64-based Systems	KB5072033 KB5072014	Security Update Security Hotpatch Update	10.0.26100.7462 10.0.26100.7392	Yes Yes
Windows 11 Version 24H2 for x64-based Systems	KB5072033 KB5072014	Security Update Security Hotpatch Update	10.0.26100.7462 10.0.26100.7392	Yes Yes
Windows Server 2025	KB5072033 KB5072014	Security Update Security Hotpatch Update	10.0.26100.7462 10.0.26100.7392	Yes Yes
Windows 10 Version 1607 for 32-bit Systems	KB5071543	Security Update	10.0.14393.8688	Yes
Windows 10 Version 1607 for x64-based Systems	KB5071543	Security Update	10.0.14393.8688	Yes
Windows Server 2016	KB5071543	Security Update	10.0.14393.8688	Yes
Windows Server 2016 (Server Core installation)	KB5071543	Security Update	10.0.14393.8688	Yes

ESU

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 22H2 for x64-based Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems

Security updates (9)

KB5071544 (Security Update)
KB5071547 (Security Update)
KB5071413 (Security Hotpatch Update)
KB5071546 (Security Update)
KB5072033 (Security Update)
KB5072014 (Security Hotpatch Update)
KB5071417 (Security Update)
KB5071542 (Security Update)
KB5071543 (Security Update)

NIST NVD data

NVD status: Analyzed
NVD CVSS: 7 (HIGH)
NVD weakness: CWE-362; CWE-416
Published to NVD: 9 December 2025
NVD last modified: 10 December 2025

Affected configurations (CPE)

Product	Vulnerable versions
windows 10 1607 (x64)	before 10.0.14393.8688
windows 10 1607 (x86)	before 10.0.14393.8688
windows 10 1809 (x64)	before 10.0.17763.8146
windows 10 1809 (x86)	before 10.0.17763.8146
windows 10 21h2	before 10.0.19044.6691
windows 10 22h2	before 10.0.19045.6691
windows 11 23h2	before 10.0.22631.6345
windows 11 24h2	before 10.0.26100.7392
windows 11 25h2	before 10.0.26200.7392
windows server 2016	before 10.0.14393.8688
windows server 2019	before 10.0.17763.8146
windows server 2022	before 10.0.20348.4467
windows server 2022 23h2	before 10.0.25398.2025
windows server 2025	before 10.0.26100.7392

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62573 (Vendor Advisory)

Acknowledgments

cyanbamboo and b2ahex

Revision history

Version	Date	Description
1.0	8 December 2025	Information published.