Johannes Ullrich Release Quotations

My guess is that it's just serious enough that they really felt it was necessary to release it early.

We do suspect that Microsoft will still release an early patch given the imminent danger to its customers from this flaw. As stated by the company about two years ago, patches can be released within two days if needed. Based on prior public commitments, we do suspect that Microsoft will issue the patch early once they are convinced that customers require the use of Internet Explorer in production environments.

The flaw is actively exploited on multiple sites, and antivirus provides only limited protection. Active use of an exploit without sufficient mitigating measures should warrant the early release of a patch, even a preliminary, not fully tested patch.