Microsoft patches cause zero-day, along with 71 other bugs
- Microsoft releases final Patch Tuesday update of 2024
- It addresses 71 deficiencies, including an actively exploited zero-day
- This type of error is often used in ransomware attacks, experts claim
Microsoft has released the December Patch Tuesday cumulative update, which includes a fix for a concerning zero-day vulnerability that was actively being exploited in the wild.
The bug is described as a heap-based buffer overflow vulnerability in the Windows Common Log File System driver. It is tracked as CVE-2024-49138 and can apparently be used to completely take over vulnerable systems.
American authorities have also raised the alarm about this shortcoming. The Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalogue, describing it as a bug that “poses significant risks” and urging users to apply the fix immediately.
Exploited in ransomware
There are indications that hackers are exploiting this CVE in their attacks, but we don’t know how, so whether or not it is used in ransomware is just speculation at this point.
While undoubtedly dangerous, this heap-based buffer overflow bug isn’t the only one patched this time. Microsoft has fixed a total of 71 vulnerabilities, including 16 that are considered critical because they could allow cybercriminals to remotely execute arbitrary code.
In total, Microsoft fixed 27 elevation of privilege bugs, 30 RCE bugs, 7 information disclosure bugs, 5 denial-of-service bugs, and one spoofing vulnerability. In addition to these flaws, Microsoft also patched two Edge bugs on December 5 and 6. BleepingComputer reports. The full list of fixed errors can be found here.
Via BleepingComputer
