Microsoft Corp. has patched what it describes as a critical bug in its Windows operating system that’s been present in all versions stretching back to Windows 95, according to reports. The bug could potentially allow hackers to gain remote control of any computer running an unpatched Windows OS.

The flaw was discovered by IBM’s X-Force cybersecurity research team back in May 2014, describing it as a “significant data manipulation vulnerability”.

“This complex vulnerability is a rare, “unicorn-like” bug found in code that IE relies on but doesn’t necessarily belong to,” wrote IBM researcher Robert Freeman. “The bug can be used by an attacker for drive-by attacks to reliably run code remotely and take over the user’s machine.”

Freeman explained that the bug relies on a vulnerability in VBScript, which first appeared in Internet Explorer 3.0. The bug is present even in the most recent versions of Microsoft’s browser, and is invulnerable to anti-exploitation tools like Microsoft’s Enhanced Mitigation Experience Toolkit.

Fortunately, there’s no evidence that anyone has actually discovered and used this vulnerability in the wild, probably because it’s not at all easy to pull off. However, Freeman warns that now the flaw is publicly known, it’s only a “matter of time” before attacks begin surfacing. What’s more, the discovery of this flaw will likely encourage cybercriminals to search for more data manipulation bugs that could also have been overlooked.

“These data manipulation vulnerabilities could lead to substantial exploitation scenarios from the manipulation of data values to remote code execution,” said Freeman.

Microsoft has now patched this bug, along with a host of other, less critical flaws in its latest security update. But of course, users should be reminded the patch only applies to Windows Vista and higher – Windows XP, still running on some 20 percent of all desktops, remains vulnerable.

photo credit: ~Brenda-Starr~ via photopin cc