By 
Information on five unpatched flaws in Microsoft Windows, including four believed to be high risk, has been published by security researchers working with Trend Micro’s Zero Day Initiative (ZDI).
The first three of these zero-day flaws—tracked as CVE-2020-0916, CVE-2020-0986, and CVE-2020-0915—could let a hacker to intensify privileges on the compromised system.
The security vulnerabilities were recognized in the user-mode printer driver host process splwow64.exe.
Rivals seeking to misuse these security faults would first need to acquire low privilege access to the system. Effective exploitation would let them perform code in the setting of the current user at medium veracity.
The same user-mode printer driver host process splwow64.exe was also found susceptible to a low severity information revelation bug. Traced as CVE-2020-0915 and presenting a CVSS score of 2.5, the problem results from the same dearth of authentication of a user-supplied value before being dereferenced as a pointer.
Microsoft was informed on the presence of these susceptibilities in December 2019 and was targeting to issue a patch on May 2020 Patch Tuesday, but missed the deadline. Security researchers were only provided beta fixes, for testing.
Also containing a CVSS score of 7.0 and letting attackers intensify privileges is a susceptibility in the management of WLAN connection profiles that has no CVE identifier.
“By creating a malicious profile, an attacker can disclose credentials for the machine account. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of an administrator,” ZDI explains.
