Development of a Hotfix | Microsoft Windows Security Resource Kit

Development of a Hotfix

Once product support or the MSRC identifies the need for a hotfix, the development process begins. This process differs between operating systems and applications, but the same general method is used:

The vulnerability identified by MSRC or the bug identified by product support is escalated to the Microsoft sustained engineering team.
The sustained engineering team investigates the bug and assigns it to a developer. The developer might be on the sustained engineering team or might be the core team developer responsible for the OS or application component.
The developer creates an initial hotfix. This hotfix addresses the vulnerability or bug but does not undergo testing other than that performed by the developer. This version of the hotfix is referred to as a private.
The private is sent to the customer who reported the problem to MSRC or to product support. The customer deploys the private to determine whether it corrects the problem.
If the customer reports that the bug is fixed, the sustained engineering team registers the bug against the next version of the OS or application. This ensures that the next release does not include the same bug.
The private is provided to the core team developer responsible for the OS or application component affected by the vulnerability. The developer reviews the hotfix to ensure no other issues exist.
When the developer completes her analysis, the hotfix is submitted to the build lab, which creates the hotfix and runs it through several build verification tests.
The hotfix is then passed through testers. The testers ensure that the hotfix works as expected. Because of time constraints, testing is not as extensive as the testing performed on service packs.
Localization teams review the hotfix to determine whether localized versions are required for different language versions of the OS or application. If required, localized versions are developed.
The completed hotfix is released to customers. If the hotfix is deemed a security update, Microsoft releases a related security bulletin that applies a vulnerability rating and provides further descriptions of the vulnerability.