Security researcher Abdelhamid Naceri recently discovered a new Windows zero-day local privilege elevation vulnerability that allows admin privileges in various Windows operating systems.
The vulnerability affects all versions of Windows including Windows 10, 11, and Windows Server 2022. With the vulnerability in the wrong hands, threat actors with limited access to a compromised device can use it to increase their privileges to spread to any tentacle within the system or network.
Naceri explained how the bug works with his proof-of-concept exploit: “This variant was discovered during the analysis of CVE-2021-41379 patch. the bug was not fixed correctly, however, instead of dropping the bypass. I have chosen to drop this variant as it is more powerful than the original one.”
In another revelation, Naceri pointed out that it is possible to prevent ‘Standard’ users from performing MSI installation operations by configuring group policies.