Hackers have been exploiting a flaw in Windows 10 and Windows 11 for months, even though Microsoft has since patched it.

In February, Microsoft fixed a bug in Windows 10 and Windows 11. However, this flaw was exploited by hackers for six months. This is the vulnerability CVE-2024-21338. This flaw allows attackers to easily gain access to the kernel without a legitimate user noticing.

Powerful tool

The leak isn’t enough for hackers to gain access to a system, but it is an important tool in an attack chain. To exploit the flaw, hackers must first be on a computer running Windows 10 or Windows 11. They can then exploit the flaw to gain kernel privileges. From there, they can then disable security mechanisms and install other powerful malware.

The flaw was discovered by Avast security researchers. This security company tells Bleeping Computer that criminals have been working on the zero-day vulnerability for six months. These are the North Korean Lazarus hackers. In any case, installing the updates from the last Patch Tuesday on February 13th should be a priority for everyone.