How do they find exploits like this? Do they check every single kernel functions for unchecked pointers? Do they have some automated way to discover this?
Maybe they are and this was already documented internally, but potentially marked as a low threat, but now that it was found outside of Microsoft it's a bigger problem? I'm just spitballing here, one would have to assume that Microsoft is doing static code analysis.
