Discovering two serious RCE vulnerabilities on Windows, Microsoft had to issue an emergency patch

Microsoft has just released two emergency updates to fix remote code execution (RCE) vulnerabilities that have just been discovered. These vulnerabilities affect the Microsoft Windows Codecs Library and Visual Studio Code.

The two vulnerabilities were codenamed CVE-2020-17022 and CVE-2020-17023 and were assessed as critically critical. Luckily, they have never been exploited by hackers.

FireEye Inc expert Dhanesh Kizhakkinan is the one reporting the CVE-2020-17022 vulnerability to Microsoft. Meanwhile, CVE-2020-17023 vulnerability was discovered by Jusstin Steven and reported to Microsoft.

CVE-2020-17022 affects all devices running Windows 10 version 1709 or higher and versions of the vulnerable Microsoft Windows Codecs Library. This vulnerability stems from the way the Windows Codecs Library treats objects in memory. To successfully exploit, the hacker will require the program to process a specially crafted image.

Microsoft says Windows 10 users won't be attacked if they keep the default settings. Meanwhile, users who have installed the optional HEVC or HEVC multimedia codec from the device manufacturer from the new Microsoft Store are vulnerable to attack.

If you have HEVC installed, you will need to update to the latest version. According to Microsoft, the safe HEVC version is 1.0.32762.0, 1.0.32763.0 and later.

The CVE-2020-17023 vulnerability will be triggered when the user opens the package.json file which is created in a special way to contain malicious code. The hacker can then perform a remote attack based on the current user's privileges.

If the user has administrative rights, the vulnerability CVE-2020-17023 also allows hackers to create fake administrator accounts on the device.

Microsoft says emergency patches for the two vulnerabilities will be automatically updated. 

Isabella Humphrey

Update 17 October 2020