Carrot_C4K3

**Name of the Vulnerable Software and Affected Versions** Windows 10 versions 1809 through 22H2 Windows 11 versions 21H2 through 23H2 Windows Server 2019 Windows Server 2022 Windows Server 2025 Server Core installations prior to February 2025 updates **Description** A local privilege escalation issue exists in the Windows Kernel due to a race condition and improper synchronization in the Object Manager. The flaw is specifically linked to an error in the implementation of the `NtQueryInformationToken()` function and an unchecked integer multiplication that leads to an integer overflow. This causes the kernel to allocate a buffer smaller than required, resulting in an out-of-bounds write that allows attackers to corrupt kernel memory and replace process tokens with the SYSTEM token. This can lead to a full bypass of User Account Control (UAC) and security boundaries, enabling the installation of rootkits, bootkits, and credential theft from LSA memory. The issue has been actively exploited by the Iranian threat actor OilRig (APT34) in cyber espionage campaigns targeting infrastructure in the UAE and the Gulf region. **Recommendations** Update all affected systems to Security Update KB5034763 or later cumulative updates. Enable Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) where supported to harden endpoints.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a synchronization error in the Windows kernel, specifically a "race condition" that can be exploited to elevate privileges. This can allow an attacker to gain increased access to the system. A proof-of-concept exploit has been released, demonstrating the vulnerability. The vulnerability is due to a double-fetch in `PspBuildCreateProcessContext` that leads to a stack buffer overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Server (affected versions not specified) **Description** The issue is related to errors in synchronization when using a shared resource in the Brokering File System (BFS) of Windows Server, allowing an attacker to potentially elevate their privileges. This could affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows (affected versions not specified) Description: The issue is related to a lack of authentication for a critical function in the Windows Update Stack component of the Microsoft Windows operating system. This can be exploited to allow an attacker to elevate their privileges. An elevation-of-privilege vulnerability allows attackers to affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows (affected versions not specified) Description: The issue is related to the use of insecure mechanisms for handling authentication data in the operating system's memory. It allows an attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to insufficient access control in the Windows kernel, allowing an attacker to elevate their privileges. This can affect the system, potentially leading to unauthorized access or control. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows 11 (affected versions not specified) **Description** The vulnerability is related to insufficient input validation in the Windows Themes component, allowing remote attackers to execute arbitrary code on the system. This can occur when a user opens a malicious .THEME file. The issue has been exploited in real-world incidents, with proof-of-concept exploit code published. A successful exploit could grant attackers complete control over the victim's system, allowing them to install malware, steal sensitive data, or launch further attacks within the network. **Recommendations** To resolve the issue, install Microsoft's September 2023 security updates as soon as possible to protect your system from attacks. The updates are available through Windows Update and the Microsoft Update Catalog. As a temporary workaround, consider avoiding the use of .THEME files from untrusted sources until the issue is resolved.