CVE-2021-40444
Microsoft MSHTML Remote Code Execution Vulnerability
Description
CVE-2021-40444 is a high-severity remote code execution vulnerability affecting Microsoft MSHTML, the browser rendering engine used by Microsoft Office applications. An attacker can exploit this path traversal flaw by crafting a malicious ActiveX control embedded in a specially-crafted Microsoft Office document, which when opened by a victim, allows arbitrary code execution on the target system. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it is known to have been used in ransomware campaigns. With an EPSS score of 94.33% (99.95th percentile), CVE-2021-40444 represents a near-certain exploitation threat and demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19060 |
| microsoft | windows 10 1607 | < 10.0.14393.4651 |
| microsoft | windows 10 1809 | < 10.0.17763.2183 |
| microsoft | windows 10 1909 | < 10.0.18363.1801 |
| microsoft | windows 10 2004 | < 10.0.19041.1237 |
| microsoft | windows 10 20h2 | < 10.0.19042.1237 |
| microsoft | windows 10 21h1 | < 10.0.19043.1237 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2004 | < 10.0.19041.1237 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | - |
| microsoft | windows server 2016 | < 10.0.14393.4651 |
| microsoft | windows server 2019 | < 10.0.17763.2183 |
| microsoft | windows server 2022 | < 10.0.20348.230 |
| microsoft | windows server 20h2 | < 10.0.19042.1237 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444(Mitigation, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40444(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path traversal vulnerabilities occur when software uses external input to construct a pathname intended to identify a file or directory within a restricted parent directory, but fails to properly neutralize special elements that can cause the pathname to resolve outside of that directory. In the context of CVE-2021-40444, this weakness manifests in the MSHTML component, allowing an attacker to craft malicious ActiveX controls that bypass intended directory restrictions during document rendering.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2021-40444 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting its significant threat level. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed to open a malicious document. Confidentiality (Low): Some data exposure is possible during exploitation. Integrity (High): Successful exploitation allows an attacker to make extensive unauthorized modifications to the system, including installing malware or modifying system files. Availability (Low): Limited disruption to system availability may occur. The scope is changed, meaning exploitation of the MSHTML component can impact resources beyond its own boundary, such as the host operating system. This vulnerability has been confirmed in ransomware campaigns, significantly elevating the operational risk for organizations with unpatched Windows systems running Microsoft Office.
Exploit Maturity
CVE-2021-40444 is one of the most actively exploited vulnerabilities in recent years. CISA has confirmed active exploitation in the wild through its KEV catalog listing, and the vulnerability is known to have been leveraged in ransomware attacks. Public exploit code is available via Packet Storm Security and additional proof-of-concept exploits have been published. The EPSS score of 94.33% (99.95th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most likely to be exploited across all known CVEs. Federal agencies were required to remediate by 2021-11-17 per CISA's binding operational directive, underscoring the critical urgency of patching.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft released security updates in September 2021 to address this vulnerability.
- Update all affected Windows systems to patched versions: Windows 10 1507 (>= 10.0.10240.19060), Windows 10 1607 (>= 10.0.14393.4651), Windows 10 1809 (>= 10.0.17763.2183), Windows 10 1909 (>= 10.0.18363.1801), Windows 10 2004/20H2/21H1 (>= 10.0.19041.1237), Windows Server 2016 (>= 10.0.14393.4651), Windows Server 2019 (>= 10.0.17763.2183), Windows Server 2022 (>= 10.0.20348.230), and all versions of Windows 7, 8.1, RT 8.1, and Server 2008/2012.
- As an interim mitigation, disable ActiveX controls in Microsoft Office by setting the registry key to prevent ActiveX installation and execution, and configure Office applications to open documents from the internet in Protected View.
- Monitor systems for indicators of compromise, including suspicious Office document execution, unexpected child processes spawned by Office applications, and alerts for "Suspicious Cpl File Execution" in Microsoft Defender for Endpoint.
- Implement email filtering and web content filtering to block delivery of malicious Office documents, and educate users about the risks of opening untrusted documents.
Technical Details
CVE-2021-40444 exploits the MSHTML (Trident) browser rendering engine embedded in Microsoft Office applications. The attack leverages a path traversal weakness (CWE-22) through a specially-crafted malicious ActiveX control hosted within an Office document. When a user opens the document, the MSHTML engine processes the embedded content, and the path traversal flaw allows the attacker to bypass directory restrictions and achieve remote code execution. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) reflects that exploitation is network-based with low complexity, requiring no privileges but depending on user interaction to open the malicious document. The changed scope indicates that the vulnerability in MSHTML can be leveraged to compromise the broader Windows operating system beyond the rendering engine itself.
Frequently Asked Questions
Is CVE-2021-40444 being actively exploited?
Yes. CVE-2021-40444 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. It has also been used in ransomware campaigns. The EPSS score of 94.33% (99.95th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-40444?
CVE-2021-40444 affects Microsoft Windows systems that use the MSHTML rendering engine through Microsoft Office. Affected products include Windows 10 (multiple versions from 1507 through 21H1), Windows 7, Windows 8.1, Windows RT 8.1, Windows Server 2008 through 2022, and Windows Server Semi-Annual Channel releases.
How do I fix CVE-2021-40444?
Apply the Microsoft security updates released in September 2021 for all affected Windows systems. As interim mitigations, disable ActiveX controls in Office applications and ensure documents from the internet open in Protected View. Monitor for indicators of compromise using Microsoft Defender for Endpoint.
How severe is CVE-2021-40444?
CVE-2021-40444 has a CVSS 3.1 score of 8.8 (HIGH). Combined with confirmed ransomware usage and an EPSS score in the 99.95th percentile, this is an extremely high-risk vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.