Microsoft Patches 120 CVEs Including Two Zero Days

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit a malicious webpage. The security update addresses the vulnerability by correcting how Windows Media Foundation handles objects in memory.

CVE-2020-1380 is a memory corruption vulnerability (an out-of-bounds write, CWE-787) in the Microsoft Internet Explorer scripting engine that can corrupt memory when the engine processes maliciously crafted script content. It is triggered by luring a user to visit an attacker-controlled or compromised web page in Internet Explorer or in an application that invokes the IE engine, with no authentication required. Successful exploitation allows the attacker to execute arbitrary code in the context of the current user, gaining that user's privileges on the system. All installations of the affected Microsoft Internet Explorer versions are potentially exposed, with the greatest risk to legacy and enterprise Windows systems that still browse or render content with IE. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild, while no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Apply Microsoft's June 2020 (or later) Windows cumulative security updates on every system running Internet Explorer, per the vendor instructions cited by CISA. Given the KEV listing (added 2021-11-03) and high EPSS (~24% 30-day exploitation probability, 98th percentile), treat this as a priority patch. Reduce attack surface by steering users to Microsoft Edge instead of IE for web browsing and auditing internal apps or legacy sites that still invoke the IE engine to render external content.

CVE-2020-1464 is a spoofing vulnerability in Microsoft Windows caused by improper validation of file digital signatures (CWE-347). It is triggered when Windows accepts a file whose signature is malformed or improperly formed, treating it as validly signed. An attacker who can introduce such a file onto a system can bypass security features that depend on signature verification, allowing improperly signed files to load as if trusted — a common technique for malware delivery and defense evasion. Essentially all Microsoft Windows deployments on affected versions are exposed until patched. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming exploitation in the wild, though no public proof-of-concept is known and any ransomware linkage is unconfirmed.

Do: Apply Microsoft's security updates for CVE-2020-1464 on all Windows systems per vendor instructions, prioritizing internet-facing and high-value endpoints, and verify patch coverage fleet-wide given the CISA KEV listing. Until patched, avoid relying solely on digital-signature-based trust decisions (e.g., application allowlisting or signature-gated file loading) for files of unknown origin.