Microsoft patches privilege escalation flaw exploited since 2023 – Source: www.csoonline.com

Microsoft has released fixes for 57 vulnerabilities in this month’s patch cycle, including for six flaws that have signs of in-the-wild exploitation or disclosure. One of the zero-day exploits has been used in attacks since 2023 as part of a campaign with a backdoor called PipeMagic.

None of the six zero-day flaws are rated as critical by Microsoft, but the other 51include six critical remote code execution (RCE) vulnerabilities. It’s worth noting that Microsoft uses its own severity ranking system in addition to CVSS.

Privilege escalation in Win32k driver

One of the zero-day vulnerabilities, CVE-2025-24983, is a use-after-free memory corruption in the Win32 kernel subsystem that can lead to privilege escalation. The flaw was reported to Microsoft by researchers from antivirus software ESET.

The ESET researchers said the exploit was first seen in the wild in 2023, when it was deployed on computers through a backdoor program dubbed PipeMagic. First discovered in 2022, PipeMagic is a plugin-based malware first used against organizations in Asia and last year against entities from Saudi Arabia. In the last campaign, the malware was distributed through a fake ChatGPT application written in Rust.

“The exploit targets Windows 8.1 and Server 2012 R2,” the ESET researchers said on X. “The vulnerability affects OSes released before Windows 10 build 1809, including still supported Windows Server 2016. It does not affect more recent Windows OSes such as Windows 11.”

While not remotely exploitable, privilege escalation flaws are valuable to attackers who manage to trick users into executing malware because they allow a full system takeover, in this case with SYSTEM privileges.

Vulnerabilities in file system drivers

Several of the other zero-day vulnerabilities are related to the Windows NT File System (NTFS) driver. One is a remote code execution flaw that can be triggered by the user mounting a specially crafted VHD (virtual hard disk) that triggers a buffer overflow (CVE-2025-24993).

A similar vulnerability, CVE-2025-24985, that can be exploited via a malicious VHD is located in the FAT file system driver triggering an integer overflow that leads to arbitrary code execution.

Two other zero-day vulnerabilities related to NTFS can result in information disclosure. One is exploitable via VHDs again (CVE-2025-24991) and one through USB drives inserted into the computer (CVE-2025-24984).

One security feature bypass exploited in the wild was patched in the Microsoft Management Console (CVE-2025-26633). Exploitation requires user interaction, which is why Microsoft hasn’t rated this as critical.

“Successful exploitation leads to an outcome which isn’t specified by the advisory, but since the Microsoft Management Console has a feature set which includes the creation, hosting, and distribution of custom tools for the administrative management of both hardware and software for any supported version of Windows, it’s easy enough to see why an attacker might be interested,” researchers from vulnerability intelligence firm Rapid7 stated.

The last zero-day is a use-after-free flaw in Microsoft Access (CVE-2025-26630) that can lead to remote code execution. Exploiting this vulnerability requires users to open a malicious file.