Loading story…
Zero Day Initiative disclosed two vulnerabilities in Microsoft Qlib that can lead to remote code execution as root. One issue, tracked as ZDI-26-275, is a command injection flaw in the _mount_nfs_uri function caused by improper validation of a user-supplied string before it is passed to a system call. The bug carries a CVSS score of 8.8 and can be exploited by a network-adjacent attacker without authentication, creating a direct path to arbitrary code execution on affected systems.
A second flaw, ZDI-26-274 (ZDI-CAN-27211), affects the Qlib fit function and stems from deserialization of untrusted data after improper validation of attacker-controlled input. That vulnerability has a CVSS score of 7.8 and requires user interaction, such as opening a malicious file or visiting a malicious page, before code can run with root privileges. Both issues were discovered by Peter Girnus (@gothburz), reported in May 2025, fixed by Microsoft on May 31, 2025, and publicly disclosed by ZDI on April 15, 2026.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro's Zero Day Initiative published advisories ZDI-26-274 and ZDI-26-275 for the two Microsoft Qlib flaws. The disclosures identified the vulnerabilities' technical causes, CVSS scores, and credited Peter Girnus (@gothburz) for discovery.
Microsoft fixed two vulnerabilities in Qlib: a deserialization-based remote code execution issue in the fit function and a command injection flaw in the _mount_nfs_uri function. The command injection bug could be exploited by a network-adjacent unauthenticated attacker and both issues could result in code execution as root.
Peter Girnus (@gothburz) reported a remote code execution vulnerability in Microsoft Qlib's fit function to Microsoft. The flaw involved unsafe deserialization of untrusted data and could lead to code execution as root with user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026
Microsoft disclosed and patched multiple **elevation-of-privilege vulnerabilities** in the **Windows Common Log File System (CLFS) Driver**, including `CVE-2026-40407`, `CVE-2025-62470`, and `CVE-2025-32713`. The most detailed advisory, for `CVE-2026-40407`, describes a **heap-based buffer overflow** (`CWE-122`) that allows a locally authenticated low-privilege attacker to escalate to **SYSTEM** without user interaction. Microsoft rated `CVE-2026-40407` as **Important** with a **CVSS 3.1 score of 7.8**, citing **high** impact to confidentiality, integrity, and availability. The company said the flaw had **not** been publicly disclosed and was **not** being exploited in the wild at the time of publication, assessed exploitation as unlikely, and released an official security update to remediate the issue; the related CLFS advisories indicate a continuing pattern of privilege-escalation risk in this Windows component.
Jul 12, 2026
Microsoft released its December security updates to address **72 vulnerabilities** across Windows, Office, SharePoint, Microsoft 365 Apps, System Center Operations Manager, and related platforms, including **31 remote code execution** flaws. The most severe issues affect **Windows Remote Desktop Services and Client**, **Windows LDAP**, **Hyper-V**, **Microsoft Message Queuing**, and **LSASS**, with multiple bugs rated critical because they could allow remote compromise of affected systems. The update bundle also fixes **`CVE-2024-49138`**, a privilege-escalation flaw in the **Windows Common Log File System Driver (CLFS)** that was reported as **actively exploited in the wild** and could let an authenticated attacker gain **SYSTEM** privileges. Microsoft published the release through its Security Update Guide and Mariner release notes, while defenders were urged to prioritize rapid deployment of the December patches to reduce exposure to both active exploitation and high-impact remote code execution risks.
Jul 24, 2026