# Microsoft Released an Emergency Security Update to Fix Two Bugs in Windows Codecs

**URL:** <https://onehack.st/t/microsoft-released-an-emergency-security-update-to-fix-two-bugs-in-windows-codecs/95271>\
**Category:** News & Articles\
**Tags:** programming, hacking, windows\
**Created:** [July 5, 2020, 8:30am UTC](https://onehack.st/t/microsoft-released-an-emergency-security-update-to-fix-two-bugs-in-windows-codecs/95271 "2020-07-05T08:30:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [July 5, 2020, 8:30am UTC](https://onehack.st/t/microsoft-released-an-emergency-security-update-to-fix-two-bugs-in-windows-codecs/95271/1 "2020-07-05T08:30:57Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/8/68d4af04577e6e446acaae81af768b0cd702da9f.png)

Tuesday Microsoft published two out-of-band security updates to [patch two vulnerabilities in the Microsoft Windows Codecs Library](https://www.zdnet.com/article/microsoft-releases-emergency-security-update-to-fix-two-bugs-in-windows-codecs/), reports ZDNet:

_Tracked as [CVE-2020-1425](https://microsoft-us.evyy.net/c/159047/243952/3327?u=https%3A%2F%2Fportal.msrc.microsoft.com%2Fen-us%2Fsecurity-guidance%2Fadvisory%2FCVE-2020-1425&subid1=zd-c7642c31986444e2807e3faa6111a4a9--) & [CVE-2020-1457](https://microsoft-us.evyy.net/c/159047/243952/3327?u=https%3A%2F%2Fportal.msrc.microsoft.com%2Fen-us%2Fsecurity-guidance%2Fadvisory%2FCVE-2020-1457&subid1=zd-c7642c31986444e2807e3faa6111a4a9--), the two bugs only impact Windows 10 and Windows Server 2019 distributions… Microsoft said the two security flaws can be exploited with the help of a specially crafted image file. If the malformed images are opened inside apps that utilize the built-in Windows Codecs Library to handle multimedia content, then attackers would be allowed to run malicious code on a Windows computer and potentially take over the device. The two bugs – described as two remote code execution vulnerabilities – received patches Wednesday._

 

_“Customers do not need to take any action to receive the update,” Microsoft said._