New Windows Zero-Day vulnerability disclosed on Twitter

Reading time icon 1 min. read

Readers help support MSpoweruser. We may get a commission if you buy through our links. Tooltip Icon

Read our disclosure page to find out how can you help MSPoweruser sustain the editorial team Read more

A frustrated security researcher has revealed a new zero-day bug for fully-patched Windows 10 PCs which would allow any software running on your PC to gain system-level privileges. In the now deleted tweet he said:

Here is the alpc bug as 0day: I don’t fucking care about life anymore. Neither do I ever again want to submit to MSFT anyway. Fuck all of this shit.

— SandboxEscaper (@SandboxEscaper) August 27, 2018

The bug is a local exploit (ie the software needs to be running on your PC already) and involves the Windows task scheduler.

CERT has verified the bug and reports:

Microsoft Windows task scheduler contains a vulnerability in the handling of ALPC, which can allow a local user to gain SYSTEM privileges.

A local user may be able to gain elevated (SYSTEM) privileges.

The CERT/CC is currently unaware of a practical solution to this problem.

While CERT is not aware of a solution at present Microsoft, speaking to The Register,  said they will “proactively update impacted advices as soon as possible”, and will of course regularly distributed security fixes on Patch Tuesday.

More about the topics: bug, security, windows 10