For the second time in two months, the new Windows zero-day vulnerability was found on Twitter. Microsoft Data Sharing service (dsscv.dll,) which provides data brokering between apps, and is run as a LocalSystem in the shared process of scvhost.exe is the target. If an attacker already has access to a system, they could exploit the vulnerability and elevate user privileges. Not only was the bug disclosed on Twitter, the researcher who goes by @SandboxEscaper, also published a PoC on GitHub. Other security experts were able to verify the authenticity, stating the bug affects any version of Windows 10 including the early October update. It is advised that the PoC is avoided due to the fact it has the ability to delete crucial Windows files which would then crash the OP system causing the OS to be restored. Although a specific patch date has not been given, a mirco-patch (0patch) has been released which can block exploitation attempts.
