2026-04-07 19:59 UTC
@tiraniddo
My last MSRC submission described the vulnerability in ONE SENTENCE.
MSRC said that they would not be able to proceed until I provided a video of the exploit in action.
After refusing, they escalated my case after 3 days.
I'm not convinced that PoC over-complexity is the problem here. Heck, the fact that they provided a PoC at all should be actionable, if they cared.
Replies (1)
-
@tiraniddo@infosec.exchange 2026-04-07 20:02
@wdormann actually going back it looks to me like Defender makes a copy of the file into a location the user can read, so not passing back a handle. Also not saying MSRC are in the right in any way, but certainly a super complex PoC combined with not 100% reliability won't have helped. Ideally a simple description should be enough for them but that's now how MSRC operate now. Maybe they can get Project Glasswing to the work for them in the future :)