"An authenticated user would need to run a specially-crafted program that ends up executing code with SYSTEM privileges. That's why these types of bugs are usually paired with a code execution bug to take over a system," says Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative.