The most recent exploit is “...an arbitrary file read issue” that could allow a malicious program to read the content of any file on a targeted Windows computer that would normally only be accessible with admin privileges. This vulnerability exists within a function in Windows called MsiAdvertiseProduct, which is used to generate advertising scripts, advertise products to the computer, and enable the installer to write the registry and shortcut information used to assign or publish a product to a script. According to SandboxEscaper, this exploit could allow a malicious program to force the installer to make a copy of any file in the system, regardless of privileges, and read its content. They also released a PoC, however, their GitHub account has been taken down since releasing this exploit. Their Twitter account has been suspended, as well as their alternate account. Finally, SandboxEscaper may be under investigation by the FBI. They posted a screenshot of an email from Google stating “Google has received legal process by the Federal Bureau of Investigation (Eastern District of New York) compelling the release of information related to your Google account.”
This blog post has since been removed, as has the blog posts disclosing the various exploits, but the screenshot can still be found on Twitter reposted by other hackers. The motive of this subpoena is unknown at the moment, though, as SandboxEscaper allegedly tweeted something containing a threat against the President of the United States. The tweet was quickly deleted and we are unable to locate any screenshot or mention of the specific contents of the tweet.