Microsoft releases emergency patch for Internet Explorer

All supported Windows systems will be patched outside the normal schedule. An already exploited vulnerability in Internet Explorer is in all versions from number 7. The patch will be released outside the monthly ‘patch Tuesday’ because the vulnerability may already be actively exploited.

The vulnerability makes it possible for an attacker to execute code on a computer if an infected website or wrong advertisement is loaded in Internet Explorer, Microsoft reports in a Security Bulletin. The attacker can run code with the privileges of the logged-in user, which means that users with less privileges are less at risk.

According to Zdnet, the zero-day exploit works due to a flaw in the system that allows IE to access objects in memory. If the exploit is successfully exploited, the attacker can take over the machine with the privileges of the logged-in user. The vulnerability is not in the Edge browser. For most users, the patch will be downloaded and installed automatically. For those who perform manual updates, the 3078071 update must first be installed, after which it with number 3087985 closes the leak.

It is rare that a bug in Microsoft software is patched in the meantime; that indicates that the vulnerability is being actively exploited. It is unclear whether that is the case.