CVE-2021-33742KEV · OVERDUE

Windows MSHTML Platform Remote Code Execution Vulnerability

High · published June 8, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.1th percentile for exploit probability.

1802
days past CISA
deadline
CVSS v3.1
7.5
EPSS
59%
Percentile
99.1
In the wild
Confirmed
What it is

🚨 A well-timed click could hand over your entire system! This Windows MSHTML vulnerability lets attackers execute arbitrary code just by luring a user to a crafted webpage. ⚡ Think of it like a restaurant where the chef serves a dish without checking the ingredients. If a sneaky diner swaps in dangerous items, the unsuspecting guests could end up with a nasty surprise! An attacker can exploit this vulnerability to run malicious code on your system, potentially leading to total control over your data and applications. This could result in data theft, system damage, or even a complete takeover of your machine — absolutely devastating!

Put simply

Think of it like a restaurant where the chef serves a dish without checking the ingredients. If a sneaky diner swaps in dangerous items, the unsuspecting guests could end up with a nasty surprise! This remote code execution vulnerability exists in the MSHTML platform, allowing attackers to execute arbitrary code in the context of the current user. If the user is logged in with administrative rights, the attacker could take full control of the system.

What to do

An attacker can exploit this vulnerability to run malicious code on your system, potentially leading to total control over your data and applications. This could result in data theft, system damage, or even a complete takeover of your machine — absolutely devastating! To protect yourself, ensure you patch to the latest version of Windows. Regularly update your system and consider using security tools that block malicious content. Don't let a simple click turn into a disaster! You've got this! Stay vigilant and proactive, and you’ll keep your system safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.59407 · 99.1th percentile
Published
2021-06-08T22:46Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 08 JUN 22:46Z
    Windows MSHTML Platform Remote Code Execution Vulnerability
    cvelistv5