In response to a question about this allegedly unresolved bug, a Microsoft spokesperson offered the following response, suggesting that a fix could arrive later: The problem concerns MS16-074, which fixed some flaws but still permits a 'device independent bitmap' bug that could let attackers gain access to information, according to the Project-Zero description.

Meanwhile, a problem with an older patch, discovered by a Google engineer, was publicly reported after passing a 90-day deadline for a fix. While the Flash security patches are now available, Microsoft possibly will be sticking with its previously stated plan to deliver its other February patches next month on March 14. They are rated 'Moderate' for Windows Server 2012 but 'Critical' for Windows Server 2016. For instance, the bulletins are rated 'Critical' for Windows client operating systems all the way back to Windows 8.1. Microsoft's security bulletin summary indicated that the Flash patches are designed to address remote code execution vulnerabilities for some currently supported Windows systems. That switch is supposed to happen sometime this month. Microsoft eventually plans to replace its summary announcements with a new Security Updates Guide portal.The bulletin ID numbering scheme also will get dropped. In addition, there's a security bulletin summary available for MS17-005 describing the Flash patches. The Microsoft Security Response Center offered a tersely worded announcement today about the availability of the Flash patches. No clue was offered about Microsoft's change of course. Microsoft has regularly been distributing Flash security patches, like clockwork, ever since it started the practice with Windows 8.

To ensure security, they may have considered blocking Flash for a month, for instance. Flash is considered to be a flagrant security target, so the deferral perhaps became awkward for some organizations. The failure to release was the first such patch delay in nearly 10 years, but the deferral also meant that Microsoft was putting off its Adobe Flash Player fixes. However, those February security updates were deferred till March, possibly because Microsoft had some kind of backend technical glitch happening. Typically, Microsoft would have released these security updates last week with its general 'update Tuesday' bundle. In a surprise move, Microsoft on Tuesday released security updates to the Adobe Flash Player that's integrated with Windows systems.

Adobe shockwave player updates