Homeland Security (CISA) is always on the lookout for threats to Windows. It recommends security updates which Windows users need to apply urgently to avoid being affected.
Exactly a month ago, 18th September, it published an Emergency Directive, which is rare, compelling Windows users in the Federal Agency to do a particular update in a space of three days.
Currently, CISA is not asking us to comply and it has not found any evidence with respect to the threat.
But you need to consider that when CISA says a hacker can utilize the latest vulnerability to take over a porous Windows 10 operating system and goes ahead to encourage you to comply with an emergency update, then you need to heed that advice.
CVE-2020-17022 — What You Need to Know
The Patch Tuesday usually rolls out a list of security patches and fixes to be made every month. Over 87 vulnerabilities were recently covered. Out of those, 11 were considered critical.
We were still recovering from that and on Thursday, 15 October, Microsoft confirmed 2 more security patches.
This vulnerability is rated by Microsoft as “important” instead of being critical. However, if you do not update your Windows 10, a hacker can completely take over it remotely through the use of a code.
First, CVE-2020-17023 refers to a remotely controlled execution vulnerability in Visual Studio. Second, I am worried about CVE-2020-17022.
CVE-2020-17022 relates to another remote code in the Codecs Library of Microsoft Windows. It specifically takes care of objects in the memory.
Microsoft has made it clear that the hacking threat will not have an impact on Windows devices that are still in the default configuration. However, those who have installed video codecs (HEVC) can be attacked. Also, Windows 10 versions from 1709 and above are affected.
More so, there is no way to work around the situation, currently. It is either you update your system or you stay vulnerable. As a result, CISA released an advisory.
So far, Microsoft has affirmed that people who installed video codecs (from a Device Manufacturer or optional HEVC) can be vulnerable.
The exploitation involves processing a uniquely designed malware hidden in an image file. If a Windows 10 user downloads the file and an application processes it, the hacker can remotely implement an arbitrary code.
