This month’s batch of security updates addresses 36 CVEs, seven of which are rated Critical and one of which has been exploited in the wild.
The last Patch Tuesday of 2019 is also Microsoft’s lightest of the year, with fixes for 36 vulnerabilities including one Windows zero-day flaw that has been exploited in the wild.
The elevation of privilege bug under active attack (CVE-2019-1458) exists when the Win32k component fails to properly handle objects in memory. An attacker could exploit this by first logging onto the system and running a specially crafted application to take control of a system.
