Google warns of actively exploited Windows zero-day

CVE-2016-7255 is an elevation-of-privilege flaw in the Windows kernel-mode drivers (win32k), affecting Windows Vista SP2 through Windows 10 1607 and the corresponding Windows Server releases. A local attacker who can run a crafted application can leverage the bug — public exploits target the win32k NtSetWindowLongPtr code path — to execute code with elevated kernel privileges. Successful exploitation yields SYSTEM-level privileges, typically used to escape a restricted context or to chain with a separate code-execution bug for full system compromise, including ransomware deployment. Anyone running the affected Windows versions is exposed; the flaw was a zero-day actively exploited at the time of its November 2016 disclosure, with reporting tying use to the Sofacy/'Pawn Storm' APT and Google warning of active exploitation. It was added to CISA KEV on 2021-11-03 with known ransomware use, and EPSS currently puts the 30-day exploitation probability at 81%, so defenders should treat it as actively targeted.

Do: Apply Microsoft's security update for CVE-2016-7255 (issued in the November 2016 Patch Tuesday cycle, bulletin MS16-135); on Windows 10 1507/1511/1607 this arrives via the corresponding monthly cumulative update. Prioritize patching internet-reachable servers and any system where unprivileged users can run code, since the flaw is used in the wild for post-exploitation privilege escalation (including ransomware chains per CISA KEV). After patching, hunt for suspicious local-to-SYSTEM activity around the disclosure window on legacy Windows Vista/2008/7/2012 estate that may still be running unpatched builds.

Adobe Flash Player for Windows, macOS/OS X, and Linux contains a use-after-free memory flaw (CWE-416) in which memory that has been freed is referenced again, corrupting memory when the player processes attacker-controlled Flash content remotely, typically via a malicious SWF delivered through a browser or another host application. A successful attack allows arbitrary code execution with the privileges of the user running Flash, commonly leading to full workstation compromise in browsing contexts. Anyone still running an affected Adobe Flash Player build is exposed, although the product has been end-of-life since early 2021 and CISA explicitly advises disconnecting or removing it rather than continuing to patch. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added March 3, 2022), confirming known in-the-wild exploitation, and EPSS assigns a 25.2% probability of exploitation within 30 days (98th percentile); no public proof-of-concept is known and ransomware use is unknown.

Do: Because Flash Player is end-of-life and no longer receives security updates, follow CISA's required action: uninstall or disable Flash everywhere it remains, including browser plugins, standalone installs, and legacy applications that invoke it. If removal must be delayed, ensure the latest patched release from Adobe's security advisories is in place and block or sandbox untrusted Flash content. On systems where Flash is still active, hunt for indicators of compromise given the KEV listing and high EPSS score.