CVE-2021-34448: medium-severity vulnerability in Microsoft Windows 10 Version 1507
Scripting Engine Memory Corruption Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A flaw in the scripting engine allows attackers to corrupt memory by sending specially crafted input, potentially causing the application to crash or behave unexpectedly. This vulnerability requires user interaction or specific conditions to be exploited.
CWE-787 (Out-of-bounds Write) in the scripting engine allows an attacker to write beyond allocated buffer boundaries through malformed script input. Exploitation typically requires script execution context and can result in denial of service or potential code execution depending on memory layout and mitigations.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.