Patch Tuesday looms – but no sign of fix for TIFF zero-day vulnerability

Graham Cluley
Graham Cluley
@
@[email protected]
@gcluley

Microsoft Windows Microsoft has announced that it will be releasing eight security bulletins (three rated “Critical” and five rated “Important”) as part of its regular Patch Tuesday bundle on November 12th.

The most concerning critical updates are planned to address vulnerabilities in Internet Explorer and Microsoft Windows involving remote code execution flaws, that could be exploited by hackers to infect computers without the victim’s knowledge.

What the patches won’t contain, however, is a fix for the zero-day vulnerability in the way Microsoft software handles TIFF image files. That security hole has been exploited by hackers in targeted attacks involving boobytrapped Word documents, and broader financially-motivated campaigns.

Although there is a temporary fix-it tool available for the TIFF zero-day vulnerability, it’s nothing like as good a solution as a proper, permanent fix from Microsoft.

Sign up to our free newsletter.
Security news, advice, and tips.

Dustin Childs of the Microsoft Trustworthy Computing group has published a blog post about the TIFF flaw, explaining that the firm is working on a fix and will release it “when ready”.

It goes without saying, that it’s wise to install security patches from Microsoft as soon as possible after they released. If you don’t, you’re effectively gambling that online criminals won’t learn more about the security holes and how to exploit them, and use that knowledge against computers under your control.

Found this article interesting? Follow Graham Cluley on Twitter or Mastodon to read more of the exclusive content we post.


Graham Cluley is a veteran of the cybersecurity industry, having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent analyst, he regularly makes media appearances and is an international public speaker on the topic of cybersecurity, hackers, and online privacy. Follow him on Twitter, Mastodon, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.