Security News > 2021 > May > Wormable Windows Bug Opens Door to DoS, RCE
It's the smallest monthly update from the computing giant since 2020, but it does contain a patch for a concerning wormable vulnerability found in the Windows OS. The good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known.
CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE. CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding Automation.
This most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service attack.
That said, Microsoft noted that an attacker is more likely to abuse the bug for DoS attacks in the form of a system crash rather than RCE, Childs pointed out, which mitigates the vulnerability's CVSS score of 9.9.
As for the first two, he noted they could be chained with another bug, such as the wormable bug listed above, to become highly dangerous and allow for WannaCry-style attacks.
The SharePoint bug allows an authenticated attacker to run code on remote SharePoint Servers.
News URL
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-05-11 | CVE-2021-31194 | Unspecified vulnerability in Microsoft products OLE Automation Remote Code Execution Vulnerability | 0.0 |
| 2021-05-11 | CVE-2021-26419 | Out-of-bounds Write vulnerability in Microsoft Internet Explorer 11/9 Scripting Engine Memory Corruption Vulnerability | 0.0 |