Bahare Sabouri

The vulnerability is an elevation-of-privilege issue in the Windows Task Scheduler, allowing attackers to elevate their privileges to Medium Integrity level and gain the ability to execute RPC functions restricted to privileged accounts. This vulnerability has been exploited in the wild, with the RomCom group executing malicious code outside the Firefox sandbox and launching malware from C&C servers. The attack can be performed from an AppContainer restricted environment.

An issue exists in the way Windows Search and Microsoft Office process input data, specifically related to HTML. A remote attacker can execute arbitrary code on a system by inducing a user to open a specially crafted malicious Microsoft Office document. This flaw allows for a Mark-of-the-Web (MotW) bypass, enabling the planting of files without the MotW security attribute using Windows Search.