CVE-2021-34448
Microsoft Windows Scripting Engine Memory Corruption Vulnerability
Description
CVE-2021-34448 is a medium-severity memory corruption vulnerability in the Microsoft Windows Scripting Engine. The vulnerability allows an attacker to corrupt memory through the scripting engine, potentially leading to remote code execution when a user visits a specially crafted web page. This out-of-bounds write flaw affects a broad range of Windows versions including Windows 7, Windows 8.1, Windows 10, and multiple Windows Server editions. CISA has added CVE-2021-34448 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 2.0% (83.5th percentile) indicates a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19003 |
| microsoft | windows 10 1607 | < 10.0.14393.4530 |
| microsoft | windows 10 1809 | < 10.0.17763.2061 |
| microsoft | windows 10 1909 | < 10.0.18363.1679 |
| microsoft | windows 10 2004 | < 10.0.19041.1110 |
| microsoft | windows 10 20h2 | < 10.0.19042.1110 |
| microsoft | windows 10 21h1 | < 10.0.19043.1110 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4530 |
| microsoft | windows server 2019 | < 10.0.17763.2061 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34448(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34448(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34448(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds write vulnerabilities occur when software writes data past the boundaries of allocated memory buffers. In the case of CVE-2021-34448, the Windows Scripting Engine improperly handles objects in memory, allowing an attacker to trigger an out-of-bounds write condition through maliciously crafted web content, potentially leading to arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-34448 has a CVSS 3.1 score of 6.8 (MEDIUM), though the real-world risk is elevated by confirmed active exploitation. The vulnerability is remotely exploitable over the network but requires high attack complexity and user interaction, meaning a victim must visit a malicious web page. No authentication is needed to exploit this flaw. Confidentiality (High): successful exploitation can expose sensitive data on the target system. Integrity (High): an attacker can modify system data and potentially install malicious software. Availability (None): the CVSS assessment indicates no direct availability impact from this vulnerability. The EPSS score of 2.0% (83.5th percentile) reflects a meaningful exploitation probability, particularly given the confirmed active exploitation by CISA.
Exploit Maturity
CVE-2021-34448 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17. No tagged public exploit code was identified in the available references, but the confirmed active exploitation status indicates that functional exploits exist in the threat landscape. The EPSS score of 2.0% (83.5th percentile) suggests moderate but real exploitation activity. The scripting engine attack surface makes this vulnerability particularly attractive for watering-hole attacks and drive-by download campaigns targeting users through web browsers.
Remediation
- Apply Microsoft security updates immediately as required by CISA KEV: Apply updates per vendor instructions. Patches are available through the Microsoft Security Response Center.
- Update all affected Windows systems to the patched versions: Windows 10 1507 (>= 10.0.10240.19003), Windows 10 1607 (>= 10.0.14393.4530), Windows 10 1809 (>= 10.0.17763.2061), Windows 10 1909 (>= 10.0.18363.1679), Windows 10 2004/20H2/21H1 (>= 10.0.19041.1110), Windows Server 2016 (>= 10.0.14393.4530), Windows Server 2019 (>= 10.0.17763.2061), and apply all available updates for Windows 7, 8.1, and Server 2008 R2/2012.
- Deploy web content filtering and browser isolation solutions to reduce the risk of users accessing malicious web pages that could trigger the scripting engine vulnerability.
- Ensure browser security settings are configured to restrict active scripting in untrusted zones, and consider deploying Enhanced Security Configuration on Windows Server systems.
- Monitor network traffic and endpoint telemetry for indicators of scripting engine exploitation, including anomalous browser process behavior, unexpected child processes spawned by Internet Explorer or Edge Legacy, and suspicious script execution patterns.
Technical Details
CVE-2021-34448 is an out-of-bounds write vulnerability in the Windows Scripting Engine that enables memory corruption through improper handling of objects. The attack is delivered over the network, typically through a specially crafted web page that triggers the vulnerability when processed by the scripting engine. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) indicates network-based access with high attack complexity, requiring specific conditions to be met for successful exploitation, along with user interaction in the form of visiting a malicious page. While no privileges are required, the high attack complexity reduces the exploitability score to 1.6. The scope remains unchanged, with high impact on both confidentiality and integrity but no direct availability impact.
Frequently Asked Questions
Is CVE-2021-34448 being actively exploited?
Yes. CVE-2021-34448 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 2.0% (83.5th percentile) indicates a notable exploitation probability, and federal agencies were required to remediate by November 17, 2021.
What products are affected by CVE-2021-34448?
CVE-2021-34448 affects multiple Microsoft Windows versions including Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507, 1607, 1809, 1909, 2004, 20H2, 21H1), and Windows Server editions (2008 R2, 2012, 2012 R2, 2016, 2019).
How do I fix CVE-2021-34448?
Apply the security updates provided by Microsoft through the MSRC advisory. Update to the specified patched versions for each affected Windows build. Additionally, deploy web content filtering and restrict active scripting in untrusted browser zones to reduce exposure.
How severe is CVE-2021-34448?
CVE-2021-34448 has a CVSS 3.1 score of 6.8 (MEDIUM). Despite the medium CVSS rating, CISA has confirmed active exploitation, making this vulnerability a priority for remediation. The EPSS score of 2.0% places it in the 83.5th percentile for exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.