Google Project researchers Tavis Ormandy and Natalie Silvanovich discovered a highly dangerous vulnerability in Windows over the weekend, automatically giving Microsoft 90 days to fix it.
The researchers announced their discovery via Twitter, stating that it is the worst remote code execution [flaw] ever identified in Windows.
After the researchers' disclosure, Microsoft rushed to patch the vulnerability, which it did in record time, with the available update now being sent via Windows Update.
The software giant provided more information about the vulnerability, explaining that it affected the anti-malware protection engine of Windows 7, 8.1, RT, and 10.
The remote code execution vulnerability discovered could allow an attacker to take control of a system via specially crafted emails, infected websites, or malicious instant messages.
What's worse is that attackers can exploit the flaw without users reading the malicious emails or opening the attachments, which is why Google security experts were quick to label it as one of the critical remote exploitation vulnerabilities recently discovered in Windows.
Microsoft researchers explain that if real-time protection is enabled on a vulnerable system, scanning infected files automatically triggers the exploit. If this option is disabled, the attacker must wait until users manually scan the files.
Microsoft recommends that users update their systems as soon as possible, stating that the updated version of the Malware Protection Engine is 1.1.13704.0. The vulnerable version is 1.1.13701.0.
"The update addresses a vulnerability that could allow remote code execution if Microsoft's anti-malware protection engine scans a specially crafted file. If an attacker successfully exploits this vulnerability, they could run arbitrary code in the LocalSystem account and take control of the system," Microsoft explains.
Since the LocalSystem account has access to almost all resources, there could be even more serious security implications, the researchers point out.
