Researcher says months of coordination with Microsoft have yet to produce a robust mitigation