Loading story…
Microsoft released security bulletin MS15-010 to fix six vulnerabilities in the Windows kernel-mode driver and related components, including the critical remote code execution flaw CVE-2015-0059 in Win32k.sys. The bug could let an attacker run code if a user opened a specially crafted document or visited an untrusted website containing embedded TrueType fonts. Microsoft rated the update Critical for supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT, and Windows RT 8.1, and Important for supported editions of Windows Server 2003, Windows Vista, and Windows Server 2008.
The bulletin also addressed elevation of privilege, security feature bypass, and denial of service issues, including one publicly disclosed vulnerability, CVE-2015-0010, and five privately reported flaws. Microsoft said none of the vulnerabilities were known to be under active exploitation at publication, and said the fixes strengthened parameter validation, impersonation enforcement, object handling, user-mode data validation, TrueType font error checking, and font width checks. The company separately clarified that update 3037639 was a non-security fix for text quality degradation caused by update 3013455 on some older Windows versions and was not required for security protection.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On February 18, 2015, Microsoft updated the MS15-010 bulletin. The bulletin noted that one flaw, CVE-2015-0010, had been publicly disclosed, while Microsoft said none of the vulnerabilities were known to be actively exploited at the time of publication.
On February 10, 2015, Microsoft released security bulletin MS15-010 (3036220) to address six vulnerabilities in the Windows kernel-mode driver and related components. The bulletin rated the update Critical for several supported Windows client and server versions and Important for older supported platforms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
support.microsoft.com
Open sourcetechnet.microsoft.com
Open sourcego.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its August 2025 Patch Tuesday updates to fix **107 vulnerabilities** across its product portfolio, including **13 critical** issues. The update included a **zero-day** privilege-escalation flaw in Windows Kerberos, `CVE-2025-53779`, which can allow an authenticated attacker to gain elevated privileges over the network as part of the **BadSuccessor** attack path and potentially reach **domain administrator** access through delegated managed service accounts in Active Directory. Microsoft also patched two **critical remote code execution** vulnerabilities with **CVSS 9.8** severity: `CVE-2025-50165` in **Windows Graphics** and `CVE-2025-53766` in **Windows GDI+**. Both flaws can be triggered through specially crafted image or document content, creating a path for code execution if malicious files are processed, and Microsoft urged administrators and users to apply the security updates immediately.
Jul 24, 2026
Microsoft’s June 2026 Patch Tuesday delivered a record-setting security release, with reports citing **206 to 208 CVEs** addressed across Windows, Office, Azure, SQL Server, and other products, including **32 critical** issues. Among the most urgent were multiple **Remote Desktop Client** remote code execution flaws—`CVE-2026-42985`, `CVE-2026-47289`, `CVE-2026-44801`, `CVE-2026-44799`, and `CVE-2026-48563`—that could let an attacker run code on a victim system if the user connected to a malicious Remote Desktop Server or accepted a specially crafted RDP certificate. Microsoft rated `CVE-2026-42985` as **more likely** to be exploited, while the others were assessed as less likely at publication; several of the bugs were credited to Kyeongmin Kim of KAIST Hacking Lab. Microsoft also disclosed **`CVE-2026-47291`**, a critical **HTTP.sys** remote code execution vulnerability with a **CVSS 9.8** score that can be exploited remotely without authentication or user interaction by sending a specially crafted packet to a server using the Windows HTTP Protocol Stack. Microsoft said systems using the default `MaxRequestBytes` setting are not affected, but warned that servers with higher values may be vulnerable and advised administrators to set the registry value to a safe level and restart the HTTP service or host until patches are applied. Cisco Talos published Snort coverage for many of the newly disclosed flaws, while separate reporting also highlighted one actively exploited zero-day in Microsoft Defender and additional high-risk issues in Hyper-V, DHCP Client, Secure Boot, and UEFI components.
Jul 1, 2026
Microsoft released fixes for 63 vulnerabilities across its product portfolio, including five rated **critical** and one actively exploited zero-day. The exploited flaw, tracked as **`CVE-2025-62215`**, is a Windows kernel double-free race condition that enables **local privilege escalation** to **SYSTEM** without user interaction, according to Microsoft’s Security Update Guide and CSIRT.SK reporting. The November 2025 updates also addressed additional high-severity issues spanning **Windows**, **Microsoft Office**, **Visual Studio**, **Microsoft Graphics Component (GDI+)**, and **Nuance PowerScribe 360**, with impacts including **remote code execution**, **information disclosure**, and **privilege escalation**. Security advisories for vulnerabilities including **`CVE-2025-60716`** and **`CVE-2025-62215`** were published through Microsoft’s update channels, and defenders were urged to deploy the patches promptly because one flaw was already being exploited in the wild.
Jul 24, 2026