Microsoft Vulnerability Left Unpatched for Months
Posted: February 21, 2017 to News.
Google's Project Zero team has one main goal: to find software vulnerabilities before the black hatters do, and they are very good at their job. Once a vulnerability is found, the team then gives the company 90 days to patch the vulnerability before releasing it to the public. On June 9, 2016, Project Zero member Mateusz Jurczyk found a vulnerability in MS Windows OS that impacts systems running anything from Vista Service Pack 2 to Windows 10 that could potentially allow a hacker to steal information right off of the memory through a vulnerability found in Windows Graphics Device Interface (GDI). Microsoft produced a patch on June 15. However, the patch, embarrassingly for the software giant, did not fix all the GDI vulnerabilities, prompting Jurczyk to report the vulnerability once again to Microsoft, and requesting a proof-of-concept by November 16 because, as Jurczyk states, even after the patch it was still possible to “disclose uninitialized or out-of-bounds heap bytes via pixel colors, in Internet Explorer and other GDI clients which allow the extraction of displayed image data back to the attacker." While Microsoft had planned to release its February patch on Valentines’ Day, they announced that they were going to delay it until March, stating that "a last-minute issue that could impact some customers and was not resolved in time for [Microsoft's] planned updates." Even so, the Google team released the details before the patch. Details that can be exploited by hackers. That being said, there is no need for mass panic; while the vulnerability might be known for an entire month before a fix comes, hackers need physical access to a potential victim’s PC in order to exploit the vulnerability.Protect Your Business Today
Petronella Technology Group has provided cybersecurity, compliance, and managed IT services from Raleigh, NC for over 23 years. Contact us today for a free consultation and technology assessment.
Need help implementing these strategies?
Our cybersecurity experts can assess your environment and build a tailored plan.
Get Free Assessment
![Managed IT vs Break-Fix: Which IT Support Model Actually Saves Your Business Money in 2026 [Video + Guide]](https://petronellatech.com/inc/modules/Blog/images/icons/1311.webp){kind=icon}
![Data Backup Best Practices: The 3-2-1-1-0 Strategy That Protects Your Business from Everything [Video + Guide]](https://petronellatech.com/inc/modules/Blog/images/icons/1313.webp){kind=icon}
![Disaster Recovery Planning: How to Build a DR Plan That Keeps Your Business Running Through Any Crisis [Video + Guide]](https://petronellatech.com/inc/modules/Blog/images/icons/1318.webp){kind=icon}
![IT Budget Planning for 2026: How to Allocate Technology Spending for Maximum Business Impact [Video + Guide]](https://petronellatech.com/inc/modules/Blog/images/icons/1321.webp){kind=icon}
