Microsoft COM for Windows Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists in the way that Microsoft COM for Windows handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system.</p> <p>To exploit the vulnerability, a user would have to open a specially crafted file or lure the target to a website hosting malicious JavaScript.</p> <p>The security update addresses the vulnerability by correcting how Microsoft COM for Windows handles objects in memory.</p>

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A

Microsoft COM 安全漏洞

Windows COM是美国Microsoft公司的一套软件组件的二进制接口标准。该组件使得能够与Windows服务进行实时交互。 Microsoft COM存在远程代码执行漏洞，该漏洞源于外部输入数据构造代码段的过程中，网络系统或产品未正确过滤其中的特殊元素。攻击者可利用该漏洞生成非法的代码段，修改网络系统或组件的预期的执行控制流。以下产品及版本受到影响： Windows 10 1909版本， Windows RT 8.1版本， Windows Server 2016版本， Windows 7版本， W

N/A

其他