CVE-2021-1732
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2021-1732 is a high-severity privilege escalation vulnerability in Microsoft Win32k that allows an attacker to elevate their privileges on a compromised Windows system. The Win32k component fails to properly handle objects in memory, enabling a local attacker with low privileges to execute code in kernel mode and gain full SYSTEM-level control. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it is known to be used in ransomware campaigns. With an exceptionally high EPSS score of 90.42% (99.6th percentile), the probability of exploitation is near certain.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1909 | - |
| microsoft | windows 10 2004 | - |
| microsoft | windows 10 20h2 | - |
| microsoft | windows server 1909 | - |
| microsoft | windows server 2004 | - |
| microsoft | windows server 2019 | - |
| microsoft | windows server 20h2 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161880/Win32k-ConsoleControl-Offset-Confusion.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/166169/Win32k-ConsoleControl-Offset-Confusion-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1732(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1732(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability where software writes data past the end of a buffer or before the beginning of a buffer. In the context of CVE-2021-1732, the Win32k kernel component contains a memory corruption flaw where improper handling of objects allows an attacker to write beyond intended memory boundaries, leading to privilege escalation.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-1732 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious privilege escalation risk. The vulnerability requires local access with low privileges but has low attack complexity and requires no user interaction, making it straightforward to exploit once an attacker has a foothold on the system. Successful exploitation fully compromises confidentiality, integrity, and availability, as the attacker gains kernel-mode code execution with SYSTEM privileges. The EPSS score of 90.42% (99.6th percentile) indicates near-certain exploitation activity. This vulnerability is known to be associated with ransomware campaigns, significantly increasing the operational risk for affected organizations. The combination of easy local exploitation and the ability to gain complete system control makes this vulnerability a critical target for post-compromise escalation.
Exploit Maturity
CVE-2021-1732 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and it is known to be used in ransomware campaigns. Public exploit code is available via Packet Storm Security (ConsoleControl Offset Confusion) and Packet Storm Security (Privilege Escalation), providing ready-to-use proof-of-concept exploits. The EPSS score of 90.42% (99.6th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most actively exploited in the current threat landscape. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor security updates immediately as directed by the CISA KEV catalog: Apply updates per vendor instructions. Install the February 2021 Patch Tuesday update from Microsoft that addresses the Win32k elevation of privilege.
- Verify that all Windows endpoints have received the security update across the environment. The Win32k component is present in all Windows versions, so ensure comprehensive patch coverage.
- Implement endpoint detection and response (EDR) solutions capable of detecting kernel-mode exploitation attempts and suspicious privilege escalation patterns associated with Win32k exploits.
- Apply the principle of least privilege across all user accounts and restrict local administrative access to minimize the attack surface available to post-compromise exploitation.
- Monitor for indicators of compromise associated with ransomware campaigns leveraging this vulnerability, including unusual kernel driver loading, suspicious process creation with elevated privileges, and lateral movement patterns.
Technical Details
CVE-2021-1732 is a privilege escalation vulnerability in the Windows Win32k kernel component caused by an out-of-bounds write (CWE-787) due to improper handling of objects in memory. The attack vector is local (CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring a low-privileged local attacker, but the exploit complexity is low and no user interaction is needed. The vulnerability specifically involves a ConsoleControl offset confusion in Win32k, where an attacker can manipulate kernel objects to achieve an out-of-bounds write, ultimately gaining arbitrary code execution in kernel mode. This grants the attacker SYSTEM-level privileges, enabling full control over the compromised system including the ability to install programs, modify or delete data, and create new accounts with full user rights.
Frequently Asked Questions
Is CVE-2021-1732 being actively exploited?
Yes. CVE-2021-1732 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. It is also known to be used in ransomware campaigns. The EPSS score of 90.42% (99.6th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-1732?
CVE-2021-1732 affects the Microsoft Win32k component present in Windows operating systems. The Win32k elevation of privilege vulnerability impacts multiple Windows versions. Organizations should consult the Microsoft Security Advisory (portal.msrc.microsoft.com) for specific affected versions and patches.
How do I fix CVE-2021-1732?
Apply the February 2021 security update from Microsoft per vendor instructions. Ensure all Windows endpoints are patched. Additionally, implement EDR solutions to detect exploitation attempts and enforce least-privilege policies to reduce the risk of post-compromise escalation.
How severe is CVE-2021-1732?
CVE-2021-1732 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access, the low attack complexity, no user interaction requirement, and full impact on confidentiality, integrity, and availability make it a critical threat. The association with ransomware campaigns and the extremely high EPSS score (90.42%) make immediate remediation essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.