An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The security update addresses the vulnerability by correcting how the Update Notification Manager handles files.

Improper library-identity validation (CWE-59, link-following / library substitution) in the Windows Update Medic Service waasmedicsvc.dll (Update Notification Manager), local elevation of privilege to SYSTEM (Important, EoP, AV:L/PR:L/UI:N, CVSS 7.8; listed in CISA KEV, added 2022-05-23). The Medic service runs as SYSTEM and loads remediation plugin libraries via WaasMedic::CWaasRemediation::LoadPluginLibrary after a WaasMedic::IsTrustedLibrary check. PRE: IsTrustedLibrary validated only the Authenticode signature (WTGetSignatureInfo) and the load used LoadLibraryW(path); a local attacker who could redirect or substitute the resolved plugin file (link following, CWE-59) could get the SYSTEM service to load a library that passed the weak trust check, yielding code execution as SYSTEM. Diff of waasmedicsvc.dll (Dec 2019 -> Jan 2020, KB4528760, build .628) confirms the fix: IsTrustedLibrary now calls a NEW WaasMedic::ValidateOriginalFileName that reads the loaded file's version resource (\StringFileInfo\%04x%04x\OriginalFilename via VerQueryValueW, after \VarFileInfo\Translation) and requires it (_wcsicmp) to match the expected module name, binding the library's identity beyond its signature; and LoadPluginLibrary now loads with LoadLibraryExW(path, 0, 0x80 = LOAD_LIBRARY_REQUIRE_SIGNED_TARGET). No CFR feature flag (pre-velocity 2020 build). Note: the POST build 10.0.18362.628 (SHA-256 4236c7c7...23ea) is winbindex-confirmed as the Jan-2020 fix (KB4528760, which supersedes the Dec-2019 KB4530684 = build .535); the PRE binary is confirmed pre-fix by content (it lacks ValidateOriginalFileName), though ghidriff read its PE version string as 10.0.18362.1034 rather than the expected .535 - a symbol-server version-label ambiguity. Both SHA-256 values are recorded for verification.

A local attacker redirects/substitutes the plugin library that the SYSTEM Update Medic Service loads; pre-patch only a signature was required

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Zhiniang Peng (@edwardzpeng) of Qihoo 360 Core Security and Jiadong Lu