Zero-Day Vulnerability in the Microsoft Windows Jet Database Engine

A zero-day vulnerability has been detected in the Microsoft Windows Jet Database Engine. Exploitation of the flaw could allow an attacker to perform remote code execution if a specially crafted Jet database file is sent to, and opened, on a vulnerable system. The vulnerability has been confirmed to impact Windows 7; however, as the exploited component exists in all supported versions of Windows, additional versions, including server editions, may also be affected. Microsoft has not yet issued a security update.

The NJCCIC recommends users and administrators of affected systems review the Zero Day Initiative (ZDI) blog, restrict interaction with the Jet database to trusted files only, and apply appropriate patches if and when they become available. Additionally, implement the Principle of Least Privilege to limit the impact of a successful attack and educate end users on this and similar threats.