Microsoft releases urgent security updates for Windows 10 Codecs bugs

Gandalf_The_Grey · Jul 1, 2020

Microsoft has released two out-of-band security updates to address remote code execution security vulnerabilities affecting the Microsoft Windows Codecs Library on several Windows 10 and Windows Server versions.

The two vulnerabilities are tracked as CVE-2020-1425 and CVE-2020-1457, the first one being rated as critical while the second received an important severity rating.

No mitigation available, updates will install automatically

Microsoft says that it has not identified any mitigating measures or workarounds for these two vulnerabilities.

"Affected customers will be automatically updated by Microsoft Store. Customers do not need to take any action to receive the update," Microsoft explains,

"Alternatively, customers who want to receive the update immediately can check for updates with the Microsoft Store App; more information on this process can be found here."

Both vulnerabilities were reported to Microsoft by Abdul-Aziz Hariri, a vulnerability analysis manager at Trend Micro's Zero Day Initiative.

Gandalf_The_Grey · Jul 1, 2020

More on Ghacks:

Lack of information is a problem
Microsoft does not reveal the name of the update that it created to address the security issue. A quick check on an up-to-date Windows 10 version 2004 Surface Go device returned updates for the apps HEIF Image Extensions and HEVC Video Extensions from Device Manufacturer. It is unclear if these are the updates that Microsoft is referring to or if the company has not yet released the security update to the general population.

I will keep an eye on the updates and update the article if a Windows Codecs Library related update becomes available.

Microsoft needs to provide additional information. It is unclear how administrators can check if the updates are installed on devices because of the lack of information. Information about the nature of the vulnerability, e.g. which image formats are affected, would also be useful.

Lastly, a Store update excludes systems from receiving the update if the Store application has been uninstalled or neutralized.