Similar to a vulnerability Microsoft patched just last week Credit: Thinkstock Microsoft on Tuesday warned Windows users that cyber criminals are exploiting a zero-day vulnerability using malicious PowerPoint documents sent as email attachments. In an advisory, Microsoft outlined the bug and provided a one-click tool from its “Fixit” line that customers can use to protect their PCs until a patch is available. Although Microsoft does not label its advisories with the same four-step threat scoring system it uses for security updates, it said that a successful exploit would let hackers hijack the PC so that they could, for example, steal information or plant other malware on the machine. The vulnerability affects all versions of Windows, from the aging Windows Vista to the very newest Windows 8.1, and is within the operating system’s code that handles OLE (object linking and embedding) objects. OLE is most commonly used by Microsoft Office for embedding data from an Excel spreadsheet in, say, a Word document. “At this time, we are aware of limited, targeted attacks that attempt to exploit the vulnerability through Microsoft PowerPoint,” the advisory said. Other Office file types, however, could also be used to exploit the flaw. Ironically, Microsoft patched a similar vulnerability last week when it issued eight updates, including one that addressed a bug in OLE which, like Tuesday’s revelation, had been exploited in the wild before a patch was pushed to customers. That update was designated MS14-060 by Microsoft, and was also being exploited using malformed PowerPoint files. According to researchers at iSight Partners, the flaw fixed by MS14-060 had been used by a Russian hacker crew to target Ukrainian government agencies, NATO, Western European government agencies and companies in the telecommunications and energy sectors, since at least December 2013. iSight slapped the moniker “Sandworm” on the cyber-spy gang. While iSight got the credit for finding the OLE vulnerability Microsoft patched last week, a trio of Google security engineers and a pair from McAfee Security reported the latest bug. Microsoft did not explicitly promise to patch the zero-day, but it certainly will. The only question is when. Its next regularly-scheduled Patch Tuesday is Nov. 11, or three weeks from today. Historically, Microsoft has been hesitant to issue an emergency security update unless attack have spread widely and affected large numbers of customers. In the meantime, Microsoft has crafted a Fixit tool that, if applied, blocks the attacks seen so far. The tool is located on this support page. Microsoft also urged Windows users to pay attention to the User Account Control (UAC) pop-ups, the small alerts that require authorization before the OS is allowed to perform certain chores, like downloading files or running software. UAC, which many Windows users see as an inconvenience — and many habitually click through without a second thought — will detect the malformed PowerPoint file and not run its hidden malware without permission. “In observed attacks, User Account Control (UAC) displays a consent prompt or an elevation prompt, depending on the privileges of the current user, before a file containing the exploit is executed,” Microsoft’s advisory said. Related content news analysis Google can’t seem to quit cookies, delays killing them again Google cited regulatory challenges in its oft-delayed plans to phase out third-party cookies from its Chromium products. It now plans to eliminate cookies in 2025 By Lucas Mearian Apr 25, 2024 5 mins Chrome Browser Security Chrome OS news Apple reportedly cuts Vision Pro production due to low demand Apple analyst Ming-Chi Kuo claims Apple is putting the brakes on production of the spatial computing headset due to low demand; the Vision Pro launched in the US earlier this year. By Matthew Finnegan Apr 25, 2024 4 mins Augmented Reality Apple Virtual Reality feature Windows 11: A guide to the updates Here’s what you need to know about the latest updates to Windows 11 as they’re released from Microsoft. Now updated for KB506980 Preview, released on April 23, 2024. By Preston Gralla Apr 25, 2024 59 mins Small and Medium Business Windows 11 Windows feature Windows 10: A guide to the updates Here's what you need to know about each update to the current version of Windows 10 as it's released from Microsoft. Now updated for KB5036979 Preview, released on April 23, 2024. By Preston Gralla Apr 25, 2024 172 mins Small and Medium Business Windows 10 Microsoft Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe