Microsoft April 2023 Patch Tuesday fixes 1 zero-day, 97 flaws

​Today is Microsoft's April 2023 Patch Tuesday, and security updates fix one actively exploited zero-day vulnerability and a total of 97 flaws.

Seven vulnerabilities have been classified as 'Critical' for allowing remote code execution, the most serious of vulnerabilities.

The number of bugs in each vulnerability category is listed below:

• 20 Elevation of Privilege Vulnerabilities
• 8 Security Feature Bypass Vulnerabilities
• 45 Remote Code Execution Vulnerabilities
• 10 Information Disclosure Vulnerabilities
• 9 Denial of Service Vulnerabilities
• 6 Spoofing Vulnerabilities

This count does not include seventeen Microsoft Edge vulnerabilities fixed on April 6th.

To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5025239 cumulative update and Windows 10 KB5025221 and KB5025229 updates.

One zero-day fixed

This month's Patch Tuesday fixes one zero-day vulnerability actively exploited in attacks.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The actively exploited zero-day vulnerability in today's updates is:

CVE-2023-28252 - Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft has fixed a privilege elevation vulnerability in the Windows CLFS driver that elevates privileges to SYSTEM, the highest user privilege level in Windows.

"An attacker who successfully exploited this vulnerability could gain SYSTEM privileges," reads Microsoft's advisory.

Microsoft says that the vulnerability was discovered by Genwei Jiang with Mandiant and Quan Jin with DBAPPSecurity WeBin Lab.

However, Kaspersky says they also discovered and reported the CVE-2023-28252 vulnerability to Microsoft after seeing it exploited in Nokoyawa ransomware attacks.

While not actively exploited, Microsoft Office, Word, and Publisher remote code execution vulnerabilities were fixed today that can be exploited simply by opening malicious documents.

These vulnerabilities are tracked as CVE-2023-28285, CVE-2023-28295, CVE-2023-28287, and CVE-2023-28311. 

As these types of vulnerabilities are valuable in phishing campaigns, threat actors will likely attempt to discover how they can be exploited for use in malware distribution campaigns.

Therefore, it is strongly recommended that Microsoft Office users install today's security updates as soon as possible.

Recent updates from other companies

Other vendors who released updates in April 2023 include:

• Apple released a security updates to fix two actively exploited zero-days in iOS and macOS.
• Cisco released security updates for multiple products.
• Fortinet released security updates for multiple products.
• Google released the Android April 2023 and Google Chrome security updates.
• SAP has released its April 2023 Patch Day updates.

The April 2023 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the April 2023 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.