Microsoft Update Tuesday: December 2013, some 0

Adobe Reader and Acrobat contain a memory corruption vulnerability (CWE-119, buffer/pointer handling error) that can allow an attacker to execute arbitrary code or crash the application. The bug is triggered by processing maliciously crafted content, typically when a user opens a booby-trapped PDF document. Successful exploitation yields arbitrary code execution with the privileges of the logged-in user, while failed exploitation can cause a denial of service. Anyone running affected Adobe Reader or Acrobat installations is exposed, with desktop users who open PDFs from email or the web at greatest risk. The flaw has been exploited in the wild: CISA added it to the KEV catalog on 2022-03-03 and it carries a very high EPSS score of 78.6%, although no public proof-of-concept is known.

Do: Apply vendor-supplied updates to Adobe Reader and Acrobat immediately, per the Adobe security bulletin and the CISA KEV required action, and retire or upgrade legacy unpatched builds that are past end of support. Because exploitation requires a user to open a crafted PDF, inspect or sandbox PDFs at email and web gateways and hunt for signs of PDF exploit delivery; treat this flaw as actively exploited given the KEV listing and 78.6% EPSS.

Microsoft's WinVerifyTrust function improperly validates Windows Authenticode signatures on portable executable (PE) files, allowing crafted modifications to a signed binary — such as altered sections or checksum-table manipulation — to still pass signature verification. An attacker who tampers with a legitimately signed executable can distribute modified files that Windows and dependent security controls treat as authentic, gaining the trust of a valid digital signature and, ultimately, remote code execution in contexts that rely on signature checks. Any Microsoft Windows platform performing Authenticode verification through WinVerifyTrust is affected; the source data does not list specific Windows version ranges, but because WinVerifyTrust is core Windows functionality the exposure is very broad. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-10, indicating confirmed in-the-wild exploitation, and EPSS puts its 30-day exploitation probability at about 44.6% (99th percentile), though no public PoC is known.

Do: Apply Microsoft's updates for CVE-2013-3900 across all Windows systems per vendor instructions, as required for CISA KEV entries. Where supported, enable Microsoft's stricter certificate padding check (EnableCertPaddingCheck) per Microsoft guidance to harden signature verification against this bypass. Prioritize patching endpoints and servers that execute or validate downloaded, emailed, or otherwise externally sourced signed binaries, given confirmed exploitation and high EPSS.

Microsoft's Graphics Component contains a memory corruption vulnerability that can allow remote code execution when the component processes maliciously crafted graphics content, typically delivered inside documents or other rendered content. An attacker who successfully triggers the flaw gains the ability to execute arbitrary code on the target system in the context of the current user, inheriting that user's privileges. Any Microsoft Windows system running an affected version of the Graphics Component is exposed, since the component is part of the Windows platform and is reachable through normal document and image rendering. The flaw was exploited as a zero-day in targeted attacks — notably by the Sandworm threat group against Ukrainian government and NATO-related targets, per iSight Partners reporting — and was addressed in Microsoft's December 2013 security updates. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-15, and EPSS currently assigns an 85% probability of exploitation within 30 days (100th percentile).

Do: Apply the vendor's December 2013 security updates covering the Graphics Component (MS13-098) to all Windows systems, prioritizing legacy machines that may have never received the patch, and verify KEV remediation compliance if you are a federal agency. Because exploitation vectors historically involved malicious document rendering, reinforce email filtering and Office attack-surface reduction (e.g., blocking untrusted embedded graphics/objects) on any systems that remain unpatched.

CVE-2013-5065 is a local privilege escalation flaw caused by improper input validation (CWE-20) in NDProxy.sys, a kernel driver in Microsoft Windows. A local attacker triggers the flaw by sending malformed input that reaches the vulnerable kernel driver, bypassing the usual validation checks. Successful exploitation allows the attacker to run code with elevated (kernel/SYSTEM-level) privileges, typically taking full control of the local machine from a limited-user foothold. Per CISA, Microsoft Windows is affected; no specific version ranges are provided in the source data, so defenders should consult vendor update guidance for scope. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating it is known to be exploited in the wild, though ransomware use is listed as unknown and no public PoC is catalogued.

Do: Apply the Microsoft updates per vendor instructions as required by CISA's KEV listing, prioritizing systems that host interactive users or are entry points in your environment. Because this is a local privilege escalation, focus on limiting local/low-privileged access on Windows hosts and confirm via vendor advisories which Windows versions are in scope and patched. Treat this KEV entry as a patching priority given the confirmed in-the-wild exploitation status.