Microsoft released security updates through the Microsoft Store last week, and it caused confusion for many users who want to ensure their devices are protected.
When Microsoft releases security updates for Windows, it almost always releases them through Windows Update or as standalone updates that can be downloaded from the Microsoft Catalog.
On June 30, Microsoft released two security for remote code execution vulnerabilities in the Windows Codecs Library. The company said they affected both Windows 10 and Windows Server at the time.
Instead of providing these security updates through Windows Update, Microsoft releases them through automatic updates in the Microsoft Store.
What's even more confusing is that the advisories didn't explain which Microsoft Store apps would be updated to fix the vulnerabilities, leaving users in the dark about whether they were affected.
Vulnerabilities in HEVC video extensions
On July 1, Microsoft updated the advisories to include an FAQ that explained that Windows Server was not affected and that the vulnerabilities are in the video extensions .
This package is available from the Microsoft Store as packages named "HEVC Video Extensions" or "HEVC Video Extensions from Device Manufacturer".
Microsoft states that these are optional packages and that only people who have them installed will receive the update.
The FAQ also states that the stable version of the HEVC extensions is 1.0.31822.0, 1.0.31823.0 and that the following PowerShell can be used to check the installed package version.
Security researcher AbdulAziz Hariri, who discovered these vulnerabilities, provided some additional details to BleepingComputer.
“The vulnerabilities are in the hevcdecoder_store.dll extension (HEVC codec package). This extension is not installed by default. The vulnerabilities in this codec are triggered via HEIC images (HEIFextension package. Which is installed by default). The HEVC package can be installed in multiple ways.”
"As far as I know, the user installs them manually through the store or accepts to be installed from media apps like photos etc," Hariri told BleepingComputer.
He continued by saying, “While my computers do not have the HEVC extensions installed, I did have the HEIC image extensions installed. And those were upgraded on June 30th.”
Organizations have disabled the Microsoft Store
The exit from the regular Windows security update distribution channels makes it difficult for businesses that have intentionally disabled certain Windows features.
For companies that have disabled automatic Microsoft Store app updates, vulnerable computers will not be able to receive the fixes without removing this policy.
With a lack of initial information and the use of the Microsoft Store to distribute security updates, this release of security updates is confusing from the start.
