Microsoft Security Advisory (944653)
Vulnerability in Macrovision SECDRV.SYS Driver on Windows Could Allow Elevation of Privilege — Microsoft is working with Macrovision, investigating new public reports of a vulnerability in the Macrovision secdrv.sys driver on supported editions of Windows Server 2003 and Windows XP.
Context & Ripple Effects
This advisory lands outside the normal Patch Tuesday rhythm that Microsoft set earlier in 2007 with bulletins like MS07-036 in July — it was issued because reports of active exploitation forced Microsoft's hand rather than fitting its scheduled release cycle. The flaw sits in [[a:1181094|secdrv.sys, a Macrovision driver shipping inside supported editions of Windows XP and Windows Server 2003]], meaning the vulnerable code reached millions of machines through Microsoft's own distribution even though it was authored by a third party.
The joint Microsoft–Macrovision investigation matters because responsibility for patching is split: Microsoft controls the workaround guidance and any future update path through Windows Update, while Macrovision owns the driver itself. For enterprise administrators, an unpatchable-in-place kernel-mode hole is the worst case — mitigations have to carry the load until a fix ships.
First-order effects
- Administrators running Windows XP and Windows Server 2003 must immediately deploy Microsoft's interim workarounds for secdrv.sys, with no vendor fix yet available while the two companies investigate.
- Macrovision faces direct exposure of its anti-piracy driver technology, since the component it licenses into Windows is now a confirmed privilege-elevation vector.
Second-order effects
- Other software vendors whose kernel-mode drivers ship by default inside Windows will be pressed to audit their own code, knowing Microsoft will name and coordinate around them publicly when exploitation surfaces.
- Enterprises gain a fresh argument for hardening policies against unnecessary kernel drivers and legacy components, weighing whether secdrv.sys functionality justifies keeping the attack surface enabled at all.
Third-order effects
- If third-party kernel drivers bundled into Windows keep producing zero-days outside the Patch Tuesday cadence, expect pressure on both Microsoft and its driver partners for stricter signing, review, and faster coordinated-response commitments — a structural shift in how OS vendors police code they do not write.
The trend: Security response is expanding beyond Microsoft's monthly bulletin cycle to ad-hoc coordination with third-party driver vendors whose code rides inside Windows itself.