Microsoft Has Yet to Patch 7 Pwn2Own Zero-Days

Seven unpatched Windows privilege-escalation vulnerabilities disclosed at Pwn2Own 2024 remain outstanding; they include use-after-free, TOCTOU, heap-based buffer overflow, privilege context switching errors, improper input validation, and race conditions. Researchers fully exploited these bugs during the competition, and while Microsoft says it is working on fixes within the 90-day disclosure timeline there is no indication yet of malicious actors exploiting them in the wild. Security experts warn such escalation bugs are commonly paired with remote code execution flaws to achieve system compromise, making timely patches important given Windows' widespread use.