CVE-2021-34448KEV · OVERDUECWE-787

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Medium · published July 17, 2021

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.8. It is confirmed in active exploitation. It sits in the 98.6th percentile for exploit probability.

1803
days past CISA
deadline
CVSS v3.1
6.8
EPSS
40%
Percentile
98.6
In the wild
Confirmed
What it is

⚠️ A memory corruption vulnerability lurking in the scripting engine could let attackers run amok! 🤖 Think of this as a misplaced shipping label on a package — once it’s in the wrong hands, who knows what could get delivered? The package could contain malicious code, and if it reaches the wrong destination, chaos ensues! An attacker who successfully exploits this vulnerability could manipulate the memory of an affected application, potentially leading to unauthorized code execution. Although it's categorized as medium severity, the risks can escalate quickly, resulting in data breaches or system compromise if not addressed.

Put simply

Think of this as a misplaced shipping label on a package — once it’s in the wrong hands, who knows what could get delivered? The package could contain malicious code, and if it reaches the wrong destination, chaos ensues! CVE-2021-34448 is a memory corruption flaw in the scripting engine which occurs when it incorrectly handles objects in memory. This bug can be exploited to execute arbitrary code within the context of the user running the application.

What to do

An attacker who successfully exploits this vulnerability could manipulate the memory of an affected application, potentially leading to unauthorized code execution. Although it's categorized as medium severity, the risks can escalate quickly, resulting in data breaches or system compromise if not addressed. To mitigate this vulnerability, ensure that your software is updated to the latest version, where this issue has been patched. Regularly check for security updates and consider implementing additional monitoring for unusual activity in your applications. You’re on the right track! With these steps, you’ll bolster your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.40062 · 98.6th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2021-07-17T01:15Z
KEV added
2021-11-03 · due 2021-11-17
Affected products (15)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1900310.0.10240.19003
microsoft/windows_10_1607< 10.0.14393.453010.0.14393.4530
microsoft/windows_10_1809< 10.0.17763.206110.0.17763.2061
microsoft/windows_10_1909< 10.0.18363.167910.0.18363.1679
microsoft/windows_10_2004< 10.0.19041.111010.0.19041.1110
microsoft/windows_10_20h2< 10.0.19042.111010.0.19042.1110
microsoft/windows_10_21h1< 10.0.19043.111010.0.19043.1110
microsoft/windows_7all versions—
microsoft/windows_8.1all versions—
microsoft/windows_rt_8.1all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.453010.0.14393.4530
microsoft/windows_server_2019< 10.0.17763.206110.0.17763.2061
References (3)
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 16 JUL 20:19Z
    Scripting Engine Memory Corruption Vulnerability
    cvelistv5