New Windows zero-day affects every Windows version, including Windows 11 and Windows Server 2022

The original vulnerability allowed a user with a limited-privilege account to escalate privileges and delete specific files on a system. This new vulnerability, however, appears more serious.

Security researcher Abdelhamid Naceri, whose assistance Microsoft acknowledged in the notes for patch CVE-2021-41379, analysed the code and found that the bug had not been fixed correctly.

Abdelhamid published details on GitHub and explained that this variant is more powerful than the original because it completely bypasses the Group Policy included in Windows' administrative installation feature. As a result, an attacker can replace any executable on the system with an MSI file and run code as an administrator.

At present, no update fixes this vulnerability, and malware samples have been discovered in the wild. It is therefore a known vulnerability and, if not already being used, is likely to be used very soon.

As always, Windows users should run a security suite and keep all software applications updated as a precaution against malicious activity.