Six New Windows Vulnerabilities Found, Including First Rust-Based Kernel Flaw

Six new vulnerabilities have been found in Microsoft Windows. One is critical. All are serious.

Check Point Research discovered the flaws and disclosed them privately to Microsoft. Patches were released on 12 August as part of Patch Tuesday.

The risks are varied: system crashes, arbitrary code execution, and information leaks. For attackers, the attack surface is wide. For defenders, the response must be immediate.

One flaw is notable beyond its severity. It may be the first publicly disclosed vulnerability in a Rust-based component of the Windows kernel. Rust was introduced to improve memory safety, a longstanding challenge in operating systems.

But here, the flaw was not a traditional memory bug. Rust detected an underlying condition, and instead of handling it quietly, the system responded with a complete crash. 

A kernel-level crash leaves no room for recovery. The machine stops. Unsaved work is lost. For a single device, this is inconvenient. For an enterprise with thousands of endpoints, it can mean hours of interruption, loss of productivity, and a scramble to restore operations. The promise of safer code does not remove the need for relentless testing and rapid remediation.

Two other vulnerabilities deserve close attention. Both are memory corruption flaws that allow arbitrary code execution. One carries a critical severity rating. Exploitation is straightforward: an attacker delivers a specially crafted file, the user opens it, and the malicious payload executes. From there, the attacker gains the ability to run any code, deploy remote access tools, exfiltrate data, or install persistence mechanisms that survive reboots. 

The remaining vulnerabilities focus on information disclosure. While these often require local access, one case is different. CVE-2025-47984 allows a memory leak over the network. Sensitive information could be exposed without an attacker ever touching the physical device. This type of flaw can serve as a stepping stone, revealing tokens, credentials, or other artifacts that enable deeper intrusions.

The implications are broader than the six CVEs. Even in mature, widely deployed platforms, weaknesses continue to emerge. New programming languages reduce certain classes of errors but cannot eliminate them entirely. Complexity remains the enemy.

The defensive measures are familiar yet vital. Apply the August updates without delay. Monitor networks for suspicious activity. Reduce the window of exposure before these vulnerabilities are weaponized.

Check Point customers already have protections in place. Our solutions detect and block attempts to exploit these flaws, maintaining coverage even before official patches are deployed.

Security is not a fixed state. It is a cycle, discover, patch, adapt. Each vulnerability closed today is another challenge deferred to tomorrow. That cycle will not end. But it can be managed. And for defenders, that management is the difference between resilience and compromise.