Microsoft says it fixed Skype security flaw allowing DLL hijacking in Oct. 2017 when it released version 8; vulnerability still in versions 7.40 and lower
Shaun Nichols / The Register :
Context & Ripple Effects
Two days after researchers showed that the Skype update installer could be abused for DLL hijacking with system-level privileges, Microsoft's response is a version boundary rather than a patch: the flaw was fixed when the app was rewritten as version 8 in October 2017, and anything at 7.40 or below stays vulnerable. That makes the remediation path an upgrade, not a hotfix.
The answer also slots into a longer Microsoft patching arc visible in the related coverage — from the Windows zero-day Kaspersky found espionage groups exploiting to the June 2020 privilege-escalation patch that failed to fully close the bug. Fix-by-rewrite is defensible engineering, but it leaves the installed base holding the risk.
First-order effects
- Users and enterprises still running Skype 7.40 or lower have no patch available for a flaw that can yield system-level privileges — their only mitigation is upgrading to version 8.
Second-order effects
- Organizations with deployment freezes or compatibility constraints on legacy Skype builds face an upgrade-or-accept-risk decision, pushing update cadence policy into IT security planning.
Third-order effects
- If 'the rewrite is the fix' becomes standard practice, vulnerability disclosure increasingly resolves into forced platform migrations, with unpatched long-tail installs becoming the residual attack surface — a pattern the later incomplete Windows patches show is not unique to Skype.
The trend: Desktop software vendors are treating major rewrites as their security remediation mechanism, shifting patch responsibility onto users who haven't upgraded.