CVE-2021-33739KEV · OVERDUE

Microsoft DWM Core Library Elevation of Privilege Vulnerability

High · published June 8, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.4. It is confirmed in active exploitation. It sits in the 93.8th percentile for exploit probability.

1802
days past CISA
deadline
CVSS v3.1
8.4
EPSS
7%
Percentile
93.8
In the wild
Confirmed
What it is

🚨 A clever trick in the Microsoft DWM Core Library lets attackers elevate privileges with just one crafted request! ⚡ This vulnerability is like giving a hotel guest a master key that opens every room, bypassing the front desk entirely. Suddenly, they can access all the secrets stored away by other guests without anyone noticing! An attacker could exploit this vulnerability to gain elevated privileges, effectively taking control of the system. With this access, they could install malicious software, steal sensitive information, or even create new user accounts. It's a situation that could lead to absolutely devastating consequences for security!

Put simply

This vulnerability is like giving a hotel guest a master key that opens every room, bypassing the front desk entirely. Suddenly, they can access all the secrets stored away by other guests without anyone noticing! CVE-2021-33739 allows attackers to leverage improper handling of objects in memory, which can lead to elevation of privilege. This flaw primarily affects the DWM Core Library in Microsoft Windows, making it a significant threat.

What to do

An attacker could exploit this vulnerability to gain elevated privileges, effectively taking control of the system. With this access, they could install malicious software, steal sensitive information, or even create new user accounts. It's a situation that could lead to absolutely devastating consequences for security! To fix this issue, Microsoft recommends updating to the latest security patches as soon as possible. Ensure your systems are running an updated version of Windows, specifically versions that have addressed this vulnerability. Regularly check for security updates to safeguard against potential exploits. You've got this! By taking action to secure your systems, you're one step closer to being a security hero! 🛡️

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.06555 · 93.8th percentile
Published
2021-06-08T22:46Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 08 JUN 22:46Z
    Microsoft DWM Core Library Elevation of Privilege Vulnerability
    cvelistv5