Two New Windows Zero-Days Under Active Exploitation
Microsoft has rolled out patches for 183 security vulnerabilities across its products this October, including three flaws already being exploited in the wild. Among them, two zero-days affect Windows systems and allow attackers to elevate privileges. One vulnerability involves the ltmdm64.sys driver (part of the Agere modem stack), which ships with every Windows installation—even if the hardware isn’t used. Microsoft plans to remove the driver entirely in future updates to mitigate risk. The second zero-day targets the Remote Access Connection Manager (RasMan) component, marking the first known exploitation of a zero-day in that service.
Both vulnerabilities score 7.8 on the CVSS scale and permit local attackers with minimal privileges to gain higher-level access. While details on how they are being exploited remain scarce, Microsoft’s response underscores their seriousness. These issues have also been added to the U.S. CISA’s Known Exploited Vulnerabilities catalog, mandating federal agencies to apply the patch by November 4, 2025.
In addition to the Windows zero-days, the third actively exploited flaw involves a Secure Boot bypass in IGEL OS, which could enable kernel-level rootkit installation. Though exploiting this requires physical access—making it more suitable for “evil maid” style attacks—it still poses a serious threat for environments using IGEL-based virtual desktop infrastructure.
Among the many other patched issues this month, Microsoft addressed critical remote code execution, privilege escalation, and security bypass flaws in components like Windows Graphics, ASP.NET, WSUS, and URL parsing. Some of these vulnerabilities enable VM escape or allow command execution with SYSTEM privileges—escalations that can ripple through entire infrastructure environments if attackers succeed.
Other vendors also released security updates to address vulnerabilities in their software stacks, underscoring how critical it is for organizations and users alike to stay current with patches across the board.
