Microsoft fixes zero-day security flaw in latest Windows update

Yesterday was the last Patch Tuesday of 2024, and with it, Microsoft delivered a number of security updates, eliminating 71 security vulnerabilities in various Microsoft applications and services.

Microsoft classifies 16 of these vulnerabilities as “critical” and classifies all but one of the remaining issues as “high risk.” According to the company, one of these Windows security flaws is already being exploited in the wild, so it’s crucial to patch it as soon as possible.

With 1,020 security vulnerabilities patched throughout 2024, this was the second worst year for Microsoft in terms of the number of security issues. It has only been exceeded once, in 2020, with 1,250 security breaches during the year.

Microsoft offers few details on these vulnerabilities in its Security Update Guide. Dustin Childs describes Patch Tuesday much more clearly on the Trend Micro ZDI blog, always with an eye on the administrators who manage enterprise networks.

Windows security vulnerabilities patched

A large part of the vulnerabilities – 59 this time – are distributed across the different versions of Windows (10, 11 and Server) for which Microsoft always offers security updates.

Although Windows 7 and 8.1 are no longer mentioned in security reports, they could still be vulnerable. If system requirements allow, you must upgrade to Windows 10 22H2 or Windows 11 23H2 to continue receiving security updates. Windows 11 24H2 Update is available, but you may want to wait until its widespread issues are resolved.

Windows attacked in the wilderness

According to Microsoft, attacks are already being carried out against a particular security vulnerability in Windows. Known as CVE-2024-49138, this buffer overflow issue in the Shared Protocol File System driver has been identified as high risk, allowing an attacker to gain system authorization via a escalation of privileges.

In combination with a Remote Code Execution (RCE) security vulnerability, an attacker could take full control of the Windows system and cause significant damage. Such combinations are often seen in ransomware attacks, which are still on the rise today.

Advice: Not only do you need to carefully keep your operating system up to date, but you also need to protect your PC with reputable antivirus software and VPN software. Check out our top picks for the best Windows antivirus suites and the best VPN services.

Other critical Windows security flaws

Microsoft classifies a total of 16 RCE vulnerabilities in Windows as critical, with the Remote Desktop service alone accounting for nine of them. Although no actual exploitation of these vulnerabilities has been recorded yet, administrators should not ignore them.

The most notable is CVE-2024-49112, an RCE vulnerability in the Lightweight Directory Access Protocol (LDAP) that could allow an attacker to inject code without a user login and execute it with elevated privileges. Microsoft recommends disconnecting vulnerable domain controllers from the Internet as a mitigation against such attacks.

Microsoft also classifies the RCE CVE-2024-49117 vulnerability in Hyper-V as critical. Code from the guest system could break out and be executed on the host system. A simple user connection is enough for the attacker.

Office security vulnerabilities patched

Microsoft has eliminated eight security vulnerabilities in its Office products, including three RCE vulnerabilities. One was in Excel, the other was in Access, and the third (known as CVE-2024-49065) can be exploited via Outlook preview for attachments. Fortunately, according to Microsoft, the attacker cannot access user data with this vulnerability, but can prevent their availability.

The first in a long line of AI vulnerabilities?

Muzic is an open source research project from Microsoft that uses deep learning to promote the understanding and creation of music. With CVE-2024-49063, Microsoft has closed the first of many security vulnerabilities in the field of artificial intelligence.

Anyone wondering what AI vulnerabilities might look like: They look like deserialization errors. An attacker can develop malicious code that would be executed when a data stream is converted to an object.

As of December 2024, there are no new Windows tools for removing malware. The next Patch Tuesday will take place on January 14, 2025.