CVE-2021-41379KEV · OVERDUECWE-59

Microsoft Windows Installer Privilege Escalation Vulnerability

Medium · published November 10, 2021

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.5. It is confirmed in active exploitation. It sits in the 97.4th percentile for exploit probability.

1681
days past CISA
deadline
CVSS v3.1
5.5
EPSS
19%
Percentile
97.4
In the wild
Confirmed
What it is

⚠️ A seemingly innocent Windows Installer could turn your user privileges upside down! Imagine a party crasher getting a VIP pass just by showing up — that’s the risk here! Think of it like a hotel where anyone can waltz in and upgrade themselves to a fancy suite without showing any ID. This vulnerability allows an attacker to gain higher privileges without proper authorization, basically flipping the ‘Do Not Disturb’ sign on your system! An attacker could exploit this flaw to elevate their privileges, potentially allowing them to install malicious software or access sensitive data. While it’s not the most catastrophic breach, it can still lead to serious compromise and unauthorized control over your system, opening doors you thought were locked!

Put simply

Think of it like a hotel where anyone can waltz in and upgrade themselves to a fancy suite without showing any ID. This vulnerability allows an attacker to gain higher privileges without proper authorization, basically flipping the ‘Do Not Disturb’ sign on your system! This elevation of privilege vulnerability in Windows Installer lets an attacker bypass security measures and execute commands with higher privileges, simply by tricking the installer. A well-crafted installation could allow malicious software to run as an administrator.

What to do

An attacker could exploit this flaw to elevate their privileges, potentially allowing them to install malicious software or access sensitive data. While it’s not the most catastrophic breach, it can still lead to serious compromise and unauthorized control over your system, opening doors you thought were locked! To remediate this, ensure you apply the latest security updates from Microsoft for Windows Installer. Regularly review permissions and limit user access to prevent unauthorized privilege escalation. Stay vigilant with your security practices! You've got this! By following these steps, you'll keep your system safer and sounder! 🛡️

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.19452 · 97.4th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2021-11-10T06:19Z
KEV added
2022-03-03 · due 2022-03-17
Affected products (20)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1911910.0.10240.19119
microsoft/windows_10_1607< 10.0.14393.477010.0.14393.4770
microsoft/windows_10_1809< 10.0.17763.230010.0.17763.2300
microsoft/windows_10_1909< 10.0.18363.191610.0.18363.1916
microsoft/windows_10_2004< 10.0.19041.134810.0.19041.1348
microsoft/windows_10_20h2< 10.0.19042.134810.0.19042.1348
microsoft/windows_10_21h1< 10.0.19043.134810.0.19043.1348
microsoft/windows_11_21h2< 10.0.22000.31810.0.22000.318
microsoft/windows_7all versions—
microsoft/windows_8.1all versions—
microsoft/windows_rt_8.1all versions—
microsoft/windows_server_2004< 10.0.19041.134810.0.19041.1348
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.477010.0.14393.4770
microsoft/windows_server_2019< 10.0.17763.230010.0.17763.2300
microsoft/windows_server_2022< 10.0.20348.35010.0.20348.350
microsoft/windows_server_20h2< 10.0.19042.134810.0.19042.1348
References (4)
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 17
    kev
  • 10 NOV 00:46Z
    Windows Installer Elevation of Privilege Vulnerability
    cvelistv5