CVE-2021-28310KEV · OVERDUE

Win32k Elevation of Privilege Vulnerability

High · published April 13, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 95.0th percentile for exploit probability.

1802
days past CISA
deadline
CVSS v3.1
7.8
EPSS
8%
Percentile
95.0
In the wild
Confirmed
What it is

⚡ Elevation of privilege alert! This Win32k vulnerability can let an attacker gain heightened access with just a crafty exploit. 🚨 Think of it like a hotel employee who can access the penthouse suite with a fake ID — once they’re in, they can do just about anything they want! An attacker could leverage this vulnerability to execute arbitrary code at a higher privilege level, potentially allowing them to install malicious software, change system settings, or steal sensitive information. It's like a burglar not just entering your home, but finding the master key to all your valuables. ⚠️

Put simply

Think of it like a hotel employee who can access the penthouse suite with a fake ID — once they’re in, they can do just about anything they want! This vulnerability resides in the Win32k component and allows attackers to gain elevated privileges through a specially crafted application, fundamentally breaking the usual barriers of user permissions.

What to do

An attacker could leverage this vulnerability to execute arbitrary code at a higher privilege level, potentially allowing them to install malicious software, change system settings, or steal sensitive information. It's like a burglar not just entering your home, but finding the master key to all your valuables. ⚠️ Patch your systems immediately! Microsoft has released updates to mitigate this vulnerability; ensure you install the latest patches and review your security policies. It's essential to monitor your systems for any unusual activity as well. 🛡️ You've got this! Act fast, and you'll keep your systems secure in no time! 💪

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.08398 · 95.0th percentile
Published
2021-04-13T19:32Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 13 APR 19:32Z
    Win32k Elevation of Privilege Vulnerability
    cvelistv5