Microsoft has released a patch for a Windows use-after-free zero-day vulnerability already being exploited to deploy malware used by the Lazarus hacking group.