Pierluigi Paganini May 08, 2017

Hackers at the Google Project Zero team have discovered another critical Windows RCE vulnerability, the worst Windows RCE in recent memory.

Security experts at Google Project Zero team have discovered another critical remote code execution (RCE) vulnerability in Microsoft Windows OS, but this time the hackers defined it as the worst Windows RCE in recent memory.

The popular Google Project Zero hacker Tavis Ormandy announced its discovery during the weekend. The expert alongside with his colleague, the researcher Natalie Silvanovich, discovered the RCE vulnerability in Windows OS.

I think @natashenka and I just discovered the worst Windows remote code exec in recent memory. This is crazy bad. Report on the way. 🔥🔥🔥

— Tavis Ormandy (@taviso) May 6, 2017

Ormandy did not provide any further details of the Windows RCE vulnerability because according to the Google bug disclosure the IT giant will give a 90-day security disclosure deadline to any company to solve the problem in their solutions and publicly disclose it.

The experts only revealed the following information on the Windows RCE vulnerability:

• The PoC exploit the Project Zero team has developed works against default Windows installations.
• The Windows RCE vulnerability could be exploited by a remote attacker.
• The attack is “wormable,” capability to spread itself.

Attack works against a default install, don't need to be on the same LAN, and it's wormable. 🔥

— Tavis Ormandy (@taviso) May 6, 2017

If you are interested in the details of the Windows RCE vulnerability discovered by the Project Zero Team, you will have to wait for 90 days.

The Google Project Team’s disclosure deadline was criticized by many security experts in the past, especially from Microsoft, but Google experts always ignored them.

If a tweet is causing panic or confusion in your organization, the problem isn't the tweet, the problem is your organization

— Natalie Silvanovich (@natashenka) May 6, 2017

In February, Google researchers disclosed the details of an unpatched flaw in the Edge and Internet Explorer browsers.

Microsoft hasn’t commented the discovery, let’s see if the tech giant will fix the issue with the May 2017 Patch Tuesday scheduled tomorrow.

Stay Tuned …

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs –  Windows RCE vulnerability, hacking)

[adrotate banner=”13″]