CVE-2021-33742
Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability
Description
CVE-2021-33742 is a HIGH vulnerability affecting Microsoft Windows, carrying a CVSS 3.1 score of 7.5. Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.71001 (98.69th percentile), this vulnerability demonstrates significant real-world exploitation activity and should be prioritized for immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.18967 |
| microsoft | windows 10 1607 | < 10.0.14393.4467 |
| microsoft | windows 10 1809 | < 10.0.17763.1999 |
| microsoft | windows 10 1909 | < 10.0.18363.1621 |
| microsoft | windows 10 2004 | < 10.0.19041.1052 |
| microsoft | windows 10 20h2 | < 10.0.19042.1052 |
| microsoft | windows 10 21h1 | < 10.0.19043.1052 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | r2; sp2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4467 |
| microsoft | windows server 2019 | < 10.0.17763.1999 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33742(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33742(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2021-33742 is classified under CWE-787 — Out-of-bounds Write. Out-of-bounds Write is a vulnerability that occurs when software writes data to a memory location outside the intended boundaries of a buffer. This can happen through buffer overflows, incorrect array indexing, pointer arithmetic errors, or integer overflows affecting size calculations. Out-of-bounds writes are extremely dangerous as they can corrupt adjacent data, overwrite control flow information (return addresses, function pointers), modify security flags, or corrupt heap metadata. This vulnerability consistently ranks as one of the most dangerous software weaknesses due to its direct path to arbitrary code execution.
In the context of Microsoft Windows, this weakness is particularly concerning because Out-of-bounds writes are among the most exploitable and dangerous vulnerability classes. They enable direct memory corruption that attackers leverage for code execution through return address overwrites, vtable corruption, or heap exploitation techniques. Organizations using affected versions should understand that this vulnerability class has historically enabled severe compromises across enterprise environments.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-33742 carries a CVSS 3.1 score of 7.5 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker extensive access to sensitive data processed by Microsoft Windows, including configuration files, credentials, and potentially data from connected systems.
Integrity (HIGH): Attackers can modify critical system files, install backdoors, alter configurations, or deploy malware on affected systems running Microsoft Windows.
Availability (HIGH): Complete disruption of the affected service or system is possible, including denial of service, system crashes, or rendering the product inoperable.
Scope Unchanged: The vulnerability's scope is Unchanged (U), meaning exploitation is contained within the vulnerable component. The impact, while significant, is limited to the Microsoft Windows environment itself.
With an EPSS score of 0.71001 (98.69th percentile), this vulnerability ranks among the most likely to be exploited in real-world attacks, underscoring the urgency of remediation.
Exploit Maturity
CVE-2021-33742 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited, as confirmed by its inclusion in the KEV catalog. The EPSS score of 0.71001 (98.69th percentile) places it among the most exploited vulnerabilities tracked.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2021-33742. However, the confirmed exploitation in the wild means threat actors are actively using this vulnerability in attacks.
Attack surface: The network-based attack vector means any system running the affected Microsoft Windows version that is accessible over the network could be targeted. However, user interaction is required, meaning exploitation typically requires a victim to perform an action such as opening a file or visiting a malicious website.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the vendor advisory at portal.msrc.microsoft.com for specific patch guidance.
- Verify affected product versions in your environment. Identify all instances of Microsoft Windows in your infrastructure. Use asset inventory and vulnerability scanning tools to ensure no instances are missed.
- Implement interim mitigations if patching is delayed. If immediate patching is not feasible, apply network-level controls such as restricting access to the affected component, enabling enhanced logging, and monitoring for indicators of compromise.
- Scan for signs of prior exploitation. Given the confirmed active exploitation of this vulnerability, review system logs and security monitoring data for evidence of compromise. Conduct a thorough investigation if any suspicious activity is detected.
- Update detection signatures and monitoring rules. Ensure intrusion detection and prevention systems, endpoint detection tools, and SIEM rules are updated to detect exploitation attempts targeting CVE-2021-33742.
- Conduct a post-remediation review. After patching, verify the fix is effective and document the remediation actions taken. Update your vulnerability management records and assess whether any additional hardening measures are warranted.
Technical Details
CVE-2021-33742 is a HIGH-severity vulnerability in Microsoft Windows that can be exploited remotely over the network without physical access. The attack complexity is high, meaning specific conditions must be met for exploitation to succeed, reducing the likelihood of opportunistic attacks. No prior authentication or privileges are needed to initiate the attack. User interaction is required, meaning a victim must perform an action such as opening a file, clicking a link, or running a crafted application for exploitation to succeed.
Technical mechanism: Windows MSHTML Platform Remote Code Execution Vulnerability. The underlying flaw relates to Out-of-bounds Write, where Out-of-bounds Write is a vulnerability that occurs when software writes data to a memory location outside the intended boundaries of a buffer. This can happen through buffer overflows, incorrect array indexing, pointer arithmetic errors, or integer overflows affecting size calculations.
CVSS 3.1 vector analysis: The vector reflects an Attack Vector of NETWORK, Attack Complexity of HIGH, Privileges Required of NONE, User Interaction of REQUIRED, Scope UNCHANGED, and impact ratings of HIGH/HIGH/HIGH for Confidentiality/Integrity/Availability respectively. The Unchanged scope means impact is contained within the vulnerable component itself.
Frequently Asked Questions
Is CVE-2021-33742 being actively exploited?
Yes, CVE-2021-33742 is confirmed to be actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means federal agencies were required to remediate it by 2021-11-17. While no direct ransomware association has been confirmed, active exploitation is ongoing. The EPSS score of 0.71001 (98.69th percentile) further confirms significant exploitation activity.
Which products are affected by CVE-2021-33742?
This vulnerability affects Microsoft Windows. Organizations running affected versions should verify their exposure and prioritize remediation. Check vendor advisories for the complete and most current list of affected versions.
How do I fix CVE-2021-33742?
Apply updates per vendor instructions. Ensure all affected instances of Microsoft Windows are identified using vulnerability scanning and asset management tools. If immediate patching is not possible, implement network-level mitigations and enhanced monitoring. After patching, verify the fix and scan for indicators of prior compromise.
How severe is CVE-2021-33742?
CVE-2021-33742 is rated HIGH with a CVSS 3.1 score of 7.5. Its EPSS score of 0.71001 places it in the 98.69th percentile for exploitation likelihood. The vulnerability has confirmed active exploitation in the wild and was required to be remediated by federal agencies by 2021-11-17 per CISA's KEV directive.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.