Windows 10 has another zero-day vulnerability, as discovered by a security researcher who specializes in finding bugs in Microsoft’s operating system – and has previously publicly outed them without warning before.
The unpatched vulnerability highlighted by SandboxEscaper has been confirmed to work on Windows 10 (32-bit) systems, as reported by ZDNet. Furthermore, with some tweaking, it could theoretically be leveraged against any version of Windows (going as far back as Windows XP).
- Windows 10 May 2019 Update is now out
- How to protect your devices against ZombieLoad
- Everything you need to know about how to use Windows 10
Utilizing a bug in the Task Scheduler in Windows, this is a local privilege escalation security flaw, meaning it can be used by a hacker to raise an account with low-level privileges on a PC to a full admin account (in other words, allowing them to do anything on the victim’s computer).
Note, however, that this security flaw can’t be used to gain access to a PC. It’s an exploit for malicious parties who have already hacked their way onto a computer, and a way for them to subsequently elevate their privileges to be able to do more.
Even so, this is obviously something Microsoft needs to address swiftly, and will perhaps be patched in the next round of security updates to arrive in June.
More where that came from
As we mentioned at the outset, SandboxEscaper is renowned for being a thorn in Microsoft’s side, and in October 2018 she released details of a bug that can also be abused to elevate privileges on a system, and drew attention to a similar flaw back in August 2018.
More worryingly, she has also claimed that she’s found four further unpatched bugs in Windows, so we can expect more revelations in the pipeline fairly soon, no doubt.
SandboxEscaper previously highlighted these bugs on Twitter, but seemingly has had several of her Twitter accounts suspended in the past.
- Some of the best laptops of 2019 run Windows 10
Via MSPowerUser
