Microsoft patches CVE-2016-7255 zero

Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability."

CVE-2016-7255 is an elevation-of-privilege flaw in the Windows kernel-mode drivers (win32k), affecting Windows Vista SP2 through Windows 10 1607 and the corresponding Windows Server releases. A local attacker who can run a crafted application can leverage the bug — public exploits target the win32k NtSetWindowLongPtr code path — to execute code with elevated kernel privileges. Successful exploitation yields SYSTEM-level privileges, typically used to escape a restricted context or to chain with a separate code-execution bug for full system compromise, including ransomware deployment. Anyone running the affected Windows versions is exposed; the flaw was a zero-day actively exploited at the time of its November 2016 disclosure, with reporting tying use to the Sofacy/'Pawn Storm' APT and Google warning of active exploitation. It was added to CISA KEV on 2021-11-03 with known ransomware use, and EPSS currently puts the 30-day exploitation probability at 81%, so defenders should treat it as actively targeted.

Do: Apply Microsoft's security update for CVE-2016-7255 (issued in the November 2016 Patch Tuesday cycle, bulletin MS16-135); on Windows 10 1507/1511/1607 this arrives via the corresponding monthly cumulative update. Prioritize patching internet-reachable servers and any system where unprivileged users can run code, since the flaw is used in the wild for post-exploitation privilege escalation (including ransomware chains per CISA KEV). After patching, hunt for suspicious local-to-SYSTEM activity around the disclosure window on legacy Windows Vista/2008/7/2012 estate that may still be running unpatched builds.

atmfd.dll, the Adobe Type Manager (ATM) font driver in the Windows font library, improperly processes crafted OpenType fonts, allowing remote code execution. An attacker triggers the flaw by luring a user to a crafted website (or otherwise getting the user's system to parse attacker-supplied OpenType font content); no authentication is required, but user interaction is needed. Successful exploitation lets the attacker execute arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability. The affected range spans nearly every Windows release of the era, from Windows Vista SP2 through Windows 10 1607 and Windows Server 2016, so the potentially vulnerable population is enormous. The flaw is confirmed exploited in the wild (CISA KEV, added 2022-05-25, ransomware use unknown), carries a very high EPSS (~65% chance of exploitation in 30 days, 99th percentile), and Microsoft patched it in the November 2016 security updates.

Do: Apply Microsoft's November 2016 security update (MS16-144) or a later cumulative/monthly rollup that includes it, per the CISA KEV required action. For legacy systems still running Windows 7/8.1, Server 2008/2008 R2/2012, verify the patch (atmfd.dll updated) rather than assuming, since these OSes are past mainstream support. As interim mitigation, block untrusted OpenType fonts and avoid visiting untrusted websites or previewing untrusted files on unpatched systems.

Adobe Flash Player for Windows, macOS/OS X, and Linux contains a use-after-free memory flaw (CWE-416) in which memory that has been freed is referenced again, corrupting memory when the player processes attacker-controlled Flash content remotely, typically via a malicious SWF delivered through a browser or another host application. A successful attack allows arbitrary code execution with the privileges of the user running Flash, commonly leading to full workstation compromise in browsing contexts. Anyone still running an affected Adobe Flash Player build is exposed, although the product has been end-of-life since early 2021 and CISA explicitly advises disconnecting or removing it rather than continuing to patch. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added March 3, 2022), confirming known in-the-wild exploitation, and EPSS assigns a 25.2% probability of exploitation within 30 days (98th percentile); no public proof-of-concept is known and ransomware use is unknown.

Do: Because Flash Player is end-of-life and no longer receives security updates, follow CISA's required action: uninstall or disable Flash everywhere it remains, including browser plugins, standalone installs, and legacy applications that invoke it. If removal must be delayed, ensure the latest patched release from Adobe's security advisories is in place and block or sandbox untrusted Flash content. On systems where Flash is still active, hunt for indicators of compromise given the KEV listing and high EPSS score.