Microsoft released its October cumulative updates fixing 118 vulnerabilities, headlined by two actively exploited zero-days tracked as CVE-2024-43572 and CVE-2024-43573. CVE-2024-43572 (CVSS 7.8) is an MMC remote code execution flaw in which opening crafted Microsoft Saved Console (.msc) files executes arbitrary code, bypassing Mark of the Web controls via techniques rooted in GrimResource attack primitives. CVE-2024-43573 (CVSS 6.5) is a spoofing flaw in the legacy Windows MSHTML rendering engine, which remains embedded in modern operating systems to support Edge IE mode and WebBrowser COM controls.

Adversaries actively weaponized both flaws in targeted campaigns, with MSHTML spoofing serving as an evasion primitive to bypass browser sandboxes and deliver second-stage malware payloads. The release also remediated publicly disclosed zero-days in Hyper-V (CVE-2024-20659), Winlogon (CVE-2024-43583), and libcURL (CVE-2024-6197). CISA added CVE-2024-43572 and CVE-2024-43573 to its Known Exploited Vulnerabilities catalog, while Microsoft mitigated the flaws by blocking untrusted MSC files and hardening MSHTML URL parsing routines.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Legacy components like MSHTML and MMC console handlers remain high-yield evasion vectors, enabling adversaries to circumvent Mark of the Web zone restrictions, subvert application whitelisting, and execute arbitrary code without alerting standard endpoint inspection.
• Bullet 2 — Strategic & Defender Imperative: Organizations must deploy the cumulative Windows security update immediately, restrict file association policies for untrusted .msc extensions, and block legacy protocol handlers that invoke the MSHTML engine from untrusted network perimeters.