High

Windows DirectX Graphics Kernel Elevation of Privilege Vulnerability

IdentifiersCVE-2025-60716CWE-416· Use After Free

CVE-2025-60716 is an elevation of privilege vulnerability in the Windows DirectX Graphics Kernel. The flaw is described as a use-after-free condition in Windows DirectX that can be exploited by a local, authorized attacker. Supporting content indicates exploitation requires winning a race condition, and that the issue affects supported Windows versions. Successful exploitation can allow a low-privileged local user to elevate privileges, reportedly up to SYSTEM.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local authenticated attacker with low privileges to elevate privileges on the affected Windows system. The reported outcome is escalation to SYSTEM-level privileges, enabling full compromise of the local host, including execution of code with highest local privileges, tampering with protected resources, disabling defenses, credential theft, and follow-on lateral movement from the compromised machine.

Mitigation

If you can’t patch tonight, do this now.

No specific vendor workaround or feature-level mitigation is provided in the supplied content. Until patches are fully deployed, reduce exposure by limiting local access for untrusted users, enforcing least privilege, restricting the ability to run untrusted code locally, using application control, and monitoring for suspicious privilege-escalation behavior on Windows hosts. These measures only reduce exploitability and do not remediate the underlying flaw.

Remediation

Patch, then assume compromise.

Apply Microsoft's November 2025 security update that addresses CVE-2025-60716 in the Windows DirectX Graphics Kernel. Prioritize patching affected supported Windows systems, especially multi-user endpoints and systems where untrusted or low-privileged users can obtain local execution. Validate that the latest cumulative/security updates are installed across the fleet.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10 1809operating_system

Microsoft CorporationWindows 10 21h2operating_system

Microsoft CorporationWindows 10 22h2operating_system

Microsoft CorporationWindows 11 23h2operating_system

Microsoft CorporationWindows 11 24h2operating_system

Microsoft CorporationWindows 11 25h2operating_system

Microsoft CorporationWindows Server 2019operating_system

Microsoft CorporationWindows Server 2022operating_system

Microsoft CorporationWindows Server 2022 23h2operating_system

Microsoft CorporationWindows Server 2025operating_system

Microsoft CorporationWindows Server 23h2operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

bank info securityNews

Nov 13, 2025

Breach Roundup: UK Probes Chinese-Made Electric Buses

A local privilege escalation vulnerability in Windows DirectX.

govinfosecurityNews

Nov 13, 2025

Breach Roundup: UK Probes Chinese-Made Electric Buses

A local privilege escalation vulnerability in Windows DirectX.

crowdstrike blogNews

Nov 12, 2025

November 2025 Patch Tuesday: One Zero-Day and Five Critical Vulnerabilities Among 63 CVEs

A critical elevation of privilege vulnerability in the DirectX Graphics kernel, allowing local attackers to gain SYSTEM privileges via use-after-free.

talosintelligence otherNews

Nov 11, 2025

Microsoft Patch Tuesday for November 2025 - Snort rules and prominent vulnerabilities

An elevation of privilege vulnerability in the Windows DirectX Graphics Kernel caused by a use-after-free flaw. Successful exploitation requires winning a race condition.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3