Microsoft Fixes 118 Flaws Including Five Zero-Days and Two Actively Exploited Bugs

Microsoft released its October 2024 security updates with fixes for 118 vulnerabilities across Windows and other products, including 3 critical flaws, 5 zero-days, and 2 vulnerabilities reported as actively exploited in the wild. The zero-days highlighted in public reporting include CVE-2024-43573 in MSHTML, CVE-2024-43572 in Microsoft Management Console handling of .msc files, CVE-2024-6197 in libcurl, CVE-2024-20659 in Hyper-V, and CVE-2024-43583 in Winlogon. Microsoft documented the release in its Security Update Guide release notes.

The two exploited issues were identified as an MSHTML spoofing vulnerability and a Microsoft Management Console remote code execution flaw tied to malicious .msc files. Guidance accompanying the release urged organizations to prioritize rapid deployment of the October patches, with additional mitigation advice for CVE-2024-43583: administrators were advised to enable the official Microsoft IME to reduce exposure from vulnerable third-party input method editors affecting Winlogon.