Hackers attacking Windows users using unpatched vulnerability – Microsoft

MICROSOFT. The logo of French headquarters of American multinational technology company Microsoft, is pictured outside on March 6, 2018 in Issy-Les-Moulineaux, a Paris' suburb. Photo by Gerard Julien/AFP

MANILA, Philippines – Microsoft reported two vulnerabilities being actively exploited by attackers to allow them to install malware or ransomware on a computer remotely. TechCrunch added a patch will be released on April 14, though not for all affected Windows versions.

The advisory, posted Monday, March 23, is based off of how Windows handles and renders fonts.

"Two remote code execution vulnerabilities exist in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font – Adobe Type 1 PostScript format," said Microsoft

Attackers are trying to exploit this by getting users to fall for opening a "specially crafted document or viewing it in the Windows Preview pane." Once activated, the attacker can use remote code execution to set up malware on your device.

The advisory noted Windows 7 was also affected. Only enterprise users of WIndows 7 with extended security support will get the future patch, however.

A number of workarounds are available to help protect users from possible attack, including disabling the Preview Pane and Details Pane in Windows Explorer, among others. A full list of workarounds can be found here. – Rappler.com