Oruga

The issue is related to a type confusion vulnerability in the Microsoft Scripting Engine, which allows an unauthorized attacker to execute code over a network. This can be achieved by exploiting the vulnerability when a user visits a malicious webpage, particularly in Microsoft Edge or Internet Explorer mode. The vulnerability has been actively exploited in the wild.

A flaw exists in the Windows Update Stack related to improper link resolution before file access. Successful exploitation of this issue, identified as CVE-2025-21204, allows an attacker with low privileges to elevate their permissions and potentially gain SYSTEM-level access. The vulnerability stems from the Windows Update Stack incorrectly handling symbolic links on unpatched systems, enabling attackers to manipulate file access. A researcher discovered that even non-administrative users could exploit this issue to block Windows updates by creating a junction between C:inetpub and any system file. Microsoft created the C:inetpub folder as part of a security update to mitigate this vulnerability, and users are advised not to delete it. The creation of this folder has been observed even on systems without Internet Information Services (IIS) installed. A proof-of-concept exploit has been published.

An issue exists in the Windows Common Log File System (CLFS) driver where memory is used after it has been freed. This flaw allows an authorized local attacker to elevate their privileges to the SYSTEM level. The issue is caused by a race condition between the `IRP MJ CLEANUP` and `IRP MJ CLOSE` handlers, involving the `FsContext2` pointer. Real-world exploitation has been observed by ransomware operators, including the RansomEXX group and actors associated with the Storm-2460 group. In these attacks, a modular memory-resident backdoor called PipeMagic was deployed. The execution chain involved using `certutil` to download a payload and `MSBuild` to decrypt and execute it in memory. Attackers utilized the `NtQuerySystemInformation` function to obtain kernel addresses and the `RtlSetAllBits` function within the kernel to enable all process privileges by corrupting the `EPROCESS` structure. To interact with the vulnerable `clfs.sys` driver, attackers created a specific file at `C:ProgramDataSkyPdfPDUDrv.blf`. Following privilege escalation, the payload was injected into `winlogon.exe`, `procdump.exe`, and `dllhost.exe` to steal credentials from the LSASS process memory and encrypt files.

The issue is related to an integer overflow or wraparound in the Windows Fast FAT Driver, which allows an unauthorized attacker to execute code locally.

Name of the Vulnerable Software and Affected Versions: Windows Telephony Service (affected versions not specified) Description: The issue allows remote attackers to execute arbitrary code and affect the system. It is a remote code execution vulnerability in the Windows Telephony Service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Message Queuing (MSMQ) (affected versions not specified) Description: The issue is related to an uncontrolled consumption of resources in Microsoft Message Queuing (MSMQ) in Microsoft Windows operating systems. This can be exploited by a remote attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an elevation of privilege vulnerability in Windows Hyper-V NT Kernel Integration VSP, which could allow attackers to gain full system control. It is mentioned that hackers could exploit this to elevate privileges to the SYSTEM level. There are reports of this vulnerability being exploited in real-world incidents. The estimated number of potentially affected devices worldwide is not specified. Technical details about exploitation include a heap-based buffer overflow.

The issue is related to a use-after-free memory vulnerability in the Windows Line Printer Daemon (LPD) service. This vulnerability can be exploited by a remote attacker to execute arbitrary code.

The issue concerns an elevation of privilege vulnerability in Microsoft Edge. This vulnerability may allow an attacker to elevate their privileges, potentially leading to unauthorized actions on the system, exposure of sensitive information, and system compromise. No specific details about affected devices or real-world incidents are provided. Technical details about exploitation are not mentioned.

A vulnerability in Microsoft Exchange Server is related to errors in code generation management. Exploitation of this issue may allow a remote attacker to execute arbitrary code. The vulnerability affects the system and allows remote attackers to execute arbitrary code.