CVE-2021-43890KEV · OVERDUE

Microsoft Windows AppX Installer Spoofing Vulnerability

High · published December 15, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.1. It is confirmed in active exploitation. It sits in the 96.0th percentile for exploit probability.

1760
days past CISA
deadline
CVSS v3.1
7.1
EPSS
11%
Percentile
96.0
In the wild
Confirmed
What it is

⚡ A cleverly disguised package could be your system's worst nightmare! This spoofing vulnerability in Microsoft's AppX installer lets attackers craft malicious attachments that could lead to serious breaches. 🔥 Think of this like an unsuspecting diner receiving a beautifully wrapped gift that looks like a gourmet meal but is actually filled with rotten food — you won't know until it’s too late! In this case, that tempting attachment could lead to malicious software invading your system. An attacker could trick you into opening this malicious attachment, unleashing notorious malware families like Emotet or Trickbot right into your machine! If you're running with administrative rights, the damage could be absolutely devastating, with sensitive data at risk or worse — total system control in the hands of the attacker. This could affect not just you but everyone connected to your network!

Put simply

Think of this like an unsuspecting diner receiving a beautifully wrapped gift that looks like a gourmet meal but is actually filled with rotten food — you won't know until it’s too late! In this case, that tempting attachment could lead to malicious software invading your system. This vulnerability allows an attacker to exploit the ms-appinstaller URI scheme to deliver malicious packages designed to impersonate legitimate software, bypassing security measures with some clever social engineering.

What to do

An attacker could trick you into opening this malicious attachment, unleashing notorious malware families like Emotet or Trickbot right into your machine! If you're running with administrative rights, the damage could be absolutely devastating, with sensitive data at risk or worse — total system control in the hands of the attacker. This could affect not just you but everyone connected to your network! To combat this threat, update your App Installer to the latest version and double-check user permissions — make sure you're not running as an admin if you don’t need to! Also, be cautious with any unexpected attachments and consider disabling the ms-appinstaller protocol if it's been enabled on your system. You've got this! With a few simple steps, you can shield your system and stay safe from these tricky attacks. 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.11294 · 96.0th percentile
Published
2021-12-15T20:15Z
KEV added
2021-12-15 · due 2021-12-29
Affected products (2)
ProductVersionsFixed in
microsoft/app_installer< 1.161.16
microsoft/app_installer< 1.111.11
References (11)
EPSS history
Timeline
  • 15 DEC 14:15Z
    Windows AppX Installer Spoofing Vulnerability
    cvelistv5
  • 15 DEC 00:00Z
    Added to CISA KEV — remediate by Dec 29
    kev