Microsoft Windows Journal Multiple Vulnerabilities

A denial of service vulnerability exists in Windows Journal when a specially crafted Journal file is opened in Windows Journal. An attacker who successfully exploited this vulnerability could cause data loss on the target system. Note that the denial of service would not allow an attacker to execute code or to elevate their user rights.

For an attack to be successful, a user must open a specially crafted Journal file with an affected version of Windows Journal. In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted Journal file to the user and by convincing the user to open the file. The update addresses the vulnerability by correcting how Windows Journal manages objects in memory.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.