Microsoft has released an emergency out-of-band patch for a security bug that could allow attackers to take over machines running all supported versions of Windows (Windows Vista, Windows 7, 8, 8.1 and Windows RT), including machines running Windows 10 as part of the Windows Insider Program. The vulnerability was found by researchers at Google’s Project Zero and Fireeye.

In a Security Bulletin Microsoft said, “This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains embedded OpenType fonts.” The bulletin goes on to say that if successful an attacker would be able to install programs, delete, change, or view data, as well as create user accounts with full user rights.

The fix relates to a flaw in how Windows Adobe Type Manager Library handles OpenType fonts. Microsoft says that users could fall prey to an attack by opening a malicious file or visiting an untrusted webpage containing embedded OpenType fonts.

At the moment Microsoft says that while the flaw is public, there is no evidence as yet that it is being exploited. The company recommends that users follow the update to fix the issue. If you don’t have Automatic Updates enabled on your computer you can find the update here. Microsoft also stated that the update will include some non-security changes to improve the functionality of Windows 10.

Photo credit: David Goehring via Flickr