简体中文
Microsoft
says attackers are exploiting a previously undisclosed security vulnerability found in all supported versions of Windows, including Windows 10.
But the software giant said there is currently no patch for the vulnerability.
The security flaw, which Microsoft deems “critical” — its highest severity rating — is found in how Windows handles and renders fonts, according
to the advisory
posted Monday. The bug can be exploited by tricking a victim into opening a malicious document. Once the document is opened — or viewed in Windows Preview — an attacker can remotely run malware, such as ransomware, on a vulnerable device.
The advisory said that Microsoft was aware of hackers launching “limited, targeted attacks,” but did not say who was launching the attacks or at what scale.
Microsoft said it was working on a fix but that the advisory should serve as a warning until a patch is released. In the meantime, the
advisory
offered a temporary workaround for affected Windows users to mitigate the flaw until a fix is available.
The software giant typically releases its security fixes on the second Tuesday of each month, but occasionally
issues out-of-band patches
in severe cases.
A spokesperson for Microsoft did not immediately comment on the timing of a patch.
Microsoft will let some Windows 7 customers get free security updates for an extra year