Microsoft patches ‘Perfect 10’ remote code flaw

Microsoft issued a security update that fixes a vulnerability dubbed ‘Perfect 10’ that could allow remote code execution on affected Windows systems. The patch was distributed as part of the company’s latest security updates for supported Windows client and server editions.

The flaw could let an attacker run arbitrary code if a targeted device processed specially crafted data. According to the advisory, the vulnerability can be triggered without local access when a vulnerable component handles untrusted input. The privileges of the affected component determine whether an attacker can run code with the same rights as that process.

Microsoft rated the issue as high severity and provided patches for current consumer and server releases. The company did not report confirmed widespread exploitation linked to the flaw at the time of the advisory.

Microsoft wrote in its advisory: ‘Customers should apply the update to address the vulnerability.’ The guidance recommends testing updates in staging environments where appropriate, applying patches across enterprise fleets, and performing required restarts after installation.

The advisory includes mitigation guidance and detection recommendations for IT teams to monitor signs of exploitation. Microsoft maintains support channels and advisory pages to help customers identify affected systems and complete patch rollouts.

Organizations unable to install the update immediately were advised to review Microsoft’s mitigation suggestions and ensure other protections remain active and up to date, including network segmentation, firewalls, intrusion detection and endpoint defenses.

Remote code execution vulnerabilities allow attackers to run code on a victim machine and can lead to data theft, system compromise or deployment of malware such as ransomware. At the time of the update notice, no public proof-of-concept exploit tied to ‘Perfect 10’ had been widely circulated.