{"id":2301,"date":"2025-03-12T00:31:30","date_gmt":"2025-03-12T00:31:30","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=2301"},"modified":"2025-03-12T00:31:30","modified_gmt":"2025-03-12T00:31:30","slug":"microsoft-patches-privilege-escalation-flaw-exploited-since-2023","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=2301","title":{"rendered":"Microsoft patches privilege escalation flaw exploited since 2023"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Microsoft has released fixes for 57 vulnerabilities in this month\u2019s patch cycle<\/a>, including for six flaws that have signs of in-the-wild exploitation or disclosure. One of the zero-day exploits has been used in attacks since 2023 as part of a campaign with a backdoor called PipeMagic.<\/p>\n

None of the six zero-day flaws are rated as critical by Microsoft, but the other 51include six critical remote code execution<\/a> (RCE) vulnerabilities. It\u2019s worth noting that Microsoft uses its own severity ranking system in addition to CVSS.<\/p>\n

Privilege escalation in Win32k driver<\/h2>\n

One of the zero-day vulnerabilities<\/a>, CVE-2025-24983, is a use-after-free memory corruption in the Win32 kernel subsystem that can lead to privilege escalation. The flaw was reported to Microsoft by researchers from antivirus software ESET.<\/p>\n

The ESET researchers said the exploit was first seen in the wild in 2023, when it was deployed on computers through a backdoor program dubbed PipeMagic. First discovered in 2022, PipeMagic is a plugin-based malware first used against organizations in Asia and last year against entities from Saudi Arabia. In the last campaign, the malware was distributed through a fake ChatGPT application written in Rust.<\/p>\n

\u201cThe exploit targets Windows 8.1 and Server 2012 R2,\u201d the ESET researchers said on X<\/a>. \u201cThe vulnerability affects OSes released before Windows 10 build 1809, including still supported Windows Server 2016. It does not affect more recent Windows OSes such as Windows 11.\u201d<\/p>\n

While not remotely exploitable, privilege escalation flaws are valuable to attackers who manage to trick users into executing malware because they allow a full system takeover, in this case with SYSTEM privileges.<\/p>\n

Vulnerabilities in file system drivers<\/h2>\n

Several of the other zero-day vulnerabilities are related to the Windows NT File System (NTFS) driver. One is a remote code execution flaw that can be triggered by the user mounting a specially crafted VHD (virtual hard disk) that triggers a buffer overflow (CVE-2025-24993<\/a>).<\/p>\n

A similar vulnerability, CVE-2025-24985<\/a>, that can be exploited via a malicious VHD is located in the FAT file system driver triggering an integer overflow that leads to arbitrary code execution.<\/p>\n

Two other zero-day vulnerabilities related to NTFS can result in information disclosure. One is exploitable via VHDs again (CVE-2025-24991<\/a>) and one through USB drives inserted into the computer (CVE-2025-24984<\/a>).<\/p>\n

One security feature bypass exploited in the wild was patched in the Microsoft Management Console (CVE-2025-26633<\/a>). Exploitation requires user interaction, which is why Microsoft hasn\u2019t rated this as critical.<\/p>\n

\u201cSuccessful exploitation leads to an outcome which isn\u2019t specified by the advisory, but since the Microsoft Management Console has a feature set which includes the creation, hosting, and distribution of custom tools for the administrative management of both hardware and software for any supported version of Windows, it\u2019s easy enough to see why an attacker might be interested,\u201d researchers from vulnerability intelligence firm Rapid7 stated.<\/p>\n

The last zero-day is a use-after-free flaw in Microsoft Access (CVE-2025-26630<\/a>) that can lead to remote code execution. Exploiting this vulnerability requires users to open a malicious file.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Microsoft has released fixes for 57 vulnerabilities in this month\u2019s patch cycle, including for six flaws that have signs of in-the-wild exploitation or disclosure. One of the zero-day exploits has been used in attacks since 2023 as part of a campaign with a backdoor called PipeMagic. None of the six zero-day flaws are rated as […]<\/p>\n","protected":false},"author":0,"featured_media":2283,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2301","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2301"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2301"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/2301\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/2283"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}