New sophisticated technique bypasses Windows UAC

A sophisticated new technique that exploits the Windows Private Character Editor to bypass User Account Control (UAC) and achieve privilege escalation without user intervention has caused significant concern among system worldwide.

See also: Raspberry Robin hits Windows systems

The attack, discovered by Matan Bahar, exploits Microsoft's built-in Private Character Editor, which is located in C:\Windows\System32 and was originally designed to create and edit End-User Defined Characters (EUDC). These custom characters allow users to create custom glyphs that correspond to Unicode for use in documents and applications. However, security researchers have discovered that this seemingly innocent application can be weaponized to bypass Windows' security gatekeeper.

The vulnerability stems from critical settings embedded in the eudcedit.exe. Two specific metadata tags create the vulnerability:

1. `<requestedExecutionLevel level=”requireAdministrator” />` – Instructs Windows to run the binary with full administrator privileges.
2. `<autoElevate>true</autoElevate>` – Enables automatic upgrade without UAC prompts for trusted binaries when run by users in the Administrators group.

See also: Chinese hackers attack Windows systems with Ghost RAT and PhantomNet

This combination proves to be particularly dangerous. When UAC is configured with permissive settings like “ Upgrade without prompting ,” Windows automatically upgrades eudcedit.exe from Medium to High integrity without displaying any security warnings, Bahar said

The attack progresses through a carefully designed sequence that exploits the application's file management mechanisms. Attackers begin by launching the Private Character Editor, which is automatically upgraded to High Integrity. They then navigate to the font linking feature within the application's interface, which is typically compromised via the File menu.

The critical vulnerability manifests itself when users select font binding options and are prompted to save files. At this point, the elevated eudcedit.exe process can be manipulated to execute arbitrary commands. By simply typing “PowerShell” in the file dialog, attackers can create an elevated PowerShell session that inherits the elevated integrity level of the parent process.

See also: Microsoft: Improves Android control from Windows PC

Microsoft's approach to bypassing Windows UAC remains consistent with historical patterns. Since UAC is designed as a convenience feature rather than a security limitation, the company typically does not issue updates for bypass techniques. The eudcedit.exe UAC bypass demonstrates how attackers can weaponize legitimate system utilities to achieve malicious goals. The simplicity and effectiveness of this technique make it a significant concern for enterprise security teams