CVE-2021-28310
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2021-28310 is a high-severity privilege escalation vulnerability in Microsoft Windows Win32k. The Win32k component contains an out-of-bounds write vulnerability that allows a local attacker with low-level privileges to escalate to higher privileges on the affected system. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 27.82% (96.4th percentile), this vulnerability has a very high probability of exploitation and should be treated as an immediate remediation priority.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1909 | - |
| microsoft | windows 10 2004 | - |
| microsoft | windows 10 20h2 | - |
| microsoft | windows server 1909 | - |
| microsoft | windows server 2004 | - |
| microsoft | windows server 2019 | - |
| microsoft | windows server 20h2 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28310(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-28310(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability that occurs when software writes data past the end, or before the beginning, of the intended buffer. In the case of Microsoft Win32k, this out-of-bounds write flaw allows an attacker to corrupt memory in a way that enables privilege escalation from a standard user to system-level access.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-28310 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a significant local privilege escalation threat. The vulnerability requires local access and low-level privileges to exploit, but no user interaction is needed, making it easily exploitable once an attacker has initial access to the system. Confidentiality (High): Successful exploitation grants the attacker elevated privileges, enabling access to sensitive system data and credentials. Integrity (High): With escalated privileges, the attacker can modify system configurations, install persistent backdoors, and alter security settings. Availability (High): Full system control allows the attacker to disrupt services or render the system inoperable. The EPSS score of 27.82% places this vulnerability in the 96.4th percentile, indicating near-certain exploitation in real-world attacks.
Exploit Maturity
CVE-2021-28310 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17. The EPSS score of 27.82% (96.4th percentile) indicates a very high probability of exploitation, placing it among the most actively targeted vulnerabilities. While no public exploit code was identified in the available references, the high EPSS score and KEV listing strongly suggest that reliable exploit techniques are available to threat actors. This vulnerability is commonly used as a post-compromise privilege escalation vector after initial access has been gained through other means.
Remediation
- Apply vendor security updates immediately as required by the CISA KEV directive: Apply updates per vendor instructions. The remediation deadline was 2021-11-17.
- Update all affected Windows systems — Windows 10 (versions 1803, 1809, 1909, 2004, 20H2) and Windows Server (versions 1909, 2004, 2019, 20H2) — to the latest cumulative security patches from Microsoft.
- Implement the principle of least privilege across all systems, ensuring that user accounts operate with minimal necessary permissions to reduce the impact of successful exploitation.
- Deploy endpoint detection and response (EDR) solutions to monitor for suspicious Win32k exploitation behavior, including unexpected privilege escalation attempts and anomalous kernel-mode activity.
- Conduct a thorough review of systems for indicators of compromise, as this vulnerability may have been exploited prior to patching. Check for unauthorized accounts, unexpected services, and modified security configurations.
Technical Details
CVE-2021-28310 is an out-of-bounds write vulnerability (CWE-787) in the Windows Win32k kernel-mode driver. The Win32k component is responsible for handling window management and graphics device interface (GDI) operations in Windows. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack requires local access with low privileges and no user interaction. By triggering the out-of-bounds write condition, an attacker can corrupt kernel memory structures, gaining the ability to execute arbitrary code with SYSTEM-level privileges. The scope remains unchanged, meaning the impact is confined to the vulnerable Windows system, but full compromise of that system is achievable.
Frequently Asked Questions
Is CVE-2021-28310 being actively exploited?
Yes. CVE-2021-28310 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 27.82% (96.4th percentile) further indicates a very high exploitation probability, making immediate patching critical.
What products are affected by CVE-2021-28310?
CVE-2021-28310 affects multiple versions of Microsoft Windows 10 (1803, 1809, 1909, 2004, 20H2) and Windows Server (1909, 2004, 2019, 20H2). The vulnerability is in the Win32k kernel-mode driver component.
How do I fix CVE-2021-28310?
Apply the security updates provided by Microsoft for all affected Windows versions. Prioritize patching as CISA required remediation by 2021-11-17. Additionally, enforce least privilege policies and deploy endpoint monitoring to detect exploitation attempts.
How severe is CVE-2021-28310?
CVE-2021-28310 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access, the ease of exploitation and high impact across confidentiality, integrity, and availability make it a significant threat, especially as a post-compromise privilege escalation tool.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.