High · 7.0 CVE-2025-59508 EUVD-2025-93449GHSA-6r89-47f8-29j3

Windows Speech Recognition Elevation of Privilege Vulnerability

Published Nov 11, 2025 · Updated Feb 26, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 1607 Product: Windows 10 Version 1809 Product: Windows 10 Version 21H2 Product: Windows 10 Version 22H2 Product: Windows 11 version 22H3 Product: Windows 11 version 23H2 Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows Server 2016 Product: Windows Server 2016 (Server Core installation) Product: Windows Server 2019 Product: Windows Server 2019 (Server Core installation) Product: Windows Server 2022 Product: Windows Server 2022, 23H2 Edition (Server Core installation) Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 10 Version 1607	10.0.14393.0 – < 10.0.14393.8594	10.0.14393.8594
Microsoft	Windows 10 Version 1809	10.0.17763.0 – < 10.0.17763.8027	10.0.17763.8027
Microsoft	Windows 10 Version 21H2	10.0.19044.0 – < 10.0.19044.6575	10.0.19044.6575
Microsoft	Windows 10 Version 22H2	10.0.19045.0 – < 10.0.19045.6575	10.0.19045.6575
Microsoft	Windows 11 version 22H3	10.0.22631.0 – < 10.0.22631.6199	10.0.22631.6199
Microsoft	Windows 11 Version 23H2	10.0.22631.0 – < 10.0.22631.6199	10.0.22631.6199
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.7171	10.0.26100.7171
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.7171	10.0.26200.7171
Microsoft	Windows Server 2016	10.0.14393.0 – < 10.0.14393.8594	10.0.14393.8594
Microsoft	Windows Server 2016 (Server Core installation)	10.0.14393.0 – < 10.0.14393.8594	10.0.14393.8594
Microsoft	Windows Server 2019	10.0.17763.0 – < 10.0.17763.8027	10.0.17763.8027
Microsoft	Windows Server 2019 (Server Core installation)	10.0.17763.0 – < 10.0.17763.8027	10.0.17763.8027
Microsoft	Windows Server 2022	10.0.20348.0 – < 10.0.20348.4405	10.0.20348.4405
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	10.0.25398.0 – < 10.0.25398.1965	10.0.25398.1965
Microsoft	Windows Server 2025	10.0.26100.0 – < 10.0.26100.7171	10.0.26100.7171
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 – < 10.0.26100.7171	10.0.26100.7171

Advisories 3

WID-SEC-2025-2564 Microsoft Windows und Windows Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 13, 2026
NCSC-2025-0358 Kwetsbaartheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Nov 11, 2025
MSRC-CVE-2025-59508 Windows Speech Recognition Elevation of Privilege Vulnerability Microsoft Security Response Center · Nov 11, 2025

References

Windows Speech Recognition Elevation of Privilege Vulnerability vendor-advisory patch