Positive Technologies Helps Resolve Windows Zero-Day Vulnerability

Microsoft has issued an essential security update to address the CVE-2024-43629 vulnerability discovered by Sergey Tarasov from Positive Technologies’ Expert Security Center (PT ESC). The update is available for Windows 10, Windows 11, Windows Server 2025, Windows Server 2022, and Windows Server 2019. This vulnerability, rated 7.8 on the CVSS 3.1 scale, carries an “Important” severity rating.

The CVE-2024-43629 vulnerability allows attackers to exploit Local Privilege Escalation (LPE) tactics to gain system-level control once they have accessed a victim’s device. “This vulnerability was uncovered through routine research on popular programs,” stated Sergey Tarasov, Head of PT ESC’s Vulnerability Analysis Group. “Microsoft was promptly informed as part of a responsible disclosure process and released a patch swiftly. We urge all users to apply the update immediately to prevent potential exploitation.”

The PT Expert Security Center emphasized that this exploit enables attackers to escalate user privileges, giving them access to core system components, which they can use for further attacks. PT ESC has previously collaborated with Microsoft, including addressing a similar vulnerability (CVE-2017-0263) in 2017. This earlier discovery, also through PT ESC’s monitoring, identified an attack using the vulnerability in phishing emails to gain unauthorized control over Windows systems.

For users seeking comprehensive vulnerability management, tools such as MaxPatrol VM can assist in detecting and managing similar security issues.