CVE-2021-33739highunder attack

CVE-2021-33739: high-severity vulnerability in Microsoft Windows 10 Version 1909

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Published · Updated

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.4epss 6.6%
from disclosure to weapon0 days
Published on NVDJun 8
1st PoCAug 9
CISA KEV+148d
exploitation probability
6.6%top 6% of all CVEs
observed exploitation
yesCISA + VulnCheck
5 public exploit(s)
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A flaw in Microsoft's Desktop Window Manager allows an attacker with local access to gain higher privileges and take full control of the system. This is dangerous because it bypasses Windows security protections.

Technical detail

Local privilege escalation vulnerability in the DWM (Desktop Window Manager) Core Library exploited through interaction with graphical window management APIs. An authenticated local attacker can leverage this to elevate privileges to SYSTEM level, compromising system integrity and confidentiality.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Affected products
Microsoft · Windows 10 Version 1909Microsoft · Windows 10 Version 2004Microsoft · Windows 10 Version 20H2Microsoft · Windows 10 Version 21H1Microsoft · Windows Server version 2004Microsoft · Windows Server version 20H2
public PoCs found — 5
githubgithub.com/freeide2017/CVE-2021-33739-POC★ 10githubgithub.com/giwon9977/CVE-2021-33739_PoC_Analysis★ 5vulncheckvulncheck.com/xdb/31ac107a9305unverifiedvulncheckvulncheck.com/xdb/668bbacf64d2unverifiedvulncheckvulncheck.com/xdb/afe35658a490unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Windows 10 Version 1909

In the same product, most dangerous first.

CVE-2021-31166CRITICALHTTP Protocol Stack Remote Code Execution VulnerabilityEPSS 99.9%KEVCVE-2021-34527HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 99.8%KEVCVE-2022-30190HIGHMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityEPSS 99.2%KEVCVE-2021-40444HIGHMicrosoft MSHTML Remote Code Execution VulnerabilityEPSS 97.5%KEVCVE-2021-1675HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 85.3%KEVCVE-2022-26923HIGHActive Directory Domain Services Elevation of Privilege VulnerabilityEPSS 83.5%KEV
References
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33739https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33739