Microsoft Patched a Windows Zero-Day Last Month

On the first Tuesday of each month, Microsoft releases its “Patch Tuesday” update. Each Patch Tuesday contains a collection of patches for security vulnerabilities the company discovered (or had discovered for them) within Windows. It’s a good routine update, that ensures PCs are regularly protected against known security loopholes in Microsoft’s operating system.

August’s Patch Tuesday update, however, happened to be pretty significant. In addition to other important security patches, Microsoft confirmed one of the vulnerabilities patched was a zero-day. Zero-day vulnerabilities are particularly dangerous, because they indicate a flaw discovered before a developer can patch it. Usually, developers want vulnerabilities to remain a secret at least until a patch is widely available, to prevent bad actors from exploiting them for nefarious gains.

The zero-day flaw patched in August’s update is tracked as CVE-2024-38063, and is a remote code execution vulnerability. That means, if a bad actor exploits the flaw, they can take over the target’s machine by running their own code. In this case, that could happen if an attacker spammed a target’s computer with “specifically crafted IPv6 packets,” which Field Effect reports can be automated to target many systems across the world.

At the time the patch was released, Microsoft was not aware of this zero-day being exploited in the wild, which is good news. Occasionally, bad actors will not only know about these types of vulnerabilities, but will have taken advantage of them before companies like Microsoft have had the chance to patch them.

If you’ve updated your PC in the last month, you should be protected from this flaw. However, if not, make sure to update Windows as soon as possible.