In Windows, a 0-day vulnerability has been discovered that allows malicious users to gain system-level rights. The problem was reported by a Twitter user with the SandboxEscaper nickname. The exploit's PoC code is available on the GitHub.
The problem lies in the Windows task scheduler. When processing the ALPC tool, it becomes possible to obtain privileges at the SYSTEM level. It can be used by attackers to enhance the capabilities of malware.
According to the head of the coordination center CERT Will Dormann, the vulnerability remains urgent. The performance of the PoC code was tested on 64-bit Windows 10 with the latest updates. You can raise the user's rights to the SYSTEM level.
In response to a letter from The Register, a Microsoft representative announced that they were aware of the problem. The company promised to release an update fixing the vulnerability.