CVE-2021-40449
Microsoft Windows Win32k Privilege Escalation Vulnerability
Description
CVE-2021-40449 is a high-severity use after free vulnerability in the Microsoft Windows Win32k kernel driver that enables privilege escalation. An authenticated local attacker can exploit this use-after-free flaw in Win32k to escalate privileges from a standard user to SYSTEM level, gaining full control of the affected Windows system. This Win32k privilege escalation vulnerability affects a wide range of Microsoft Windows versions, from Windows 7 through Windows 11 and Windows Server 2008 through Server 2022. CISA has confirmed active exploitation of CVE-2021-40449 and has flagged it as known to be used in ransomware campaigns, with an EPSS score of 91.30% (99.7th percentile) indicating near-certain exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19086 |
| microsoft | windows 10 1607 | < 10.0.14393.4704 |
| microsoft | windows 10 1809 | < 10.0.17763.2237 |
| microsoft | windows 10 1909 | < 10.0.18363.1854 |
| microsoft | windows 10 2004 | < 10.0.19041.1288 |
| microsoft | windows 10 20h2 | < 10.0.19041.1288 |
| microsoft | windows 10 21h1 | < 10.0.19041.1288 |
| microsoft | windows 11 | All versions |
| microsoft | windows 11 21h2 | < 10.0.22000.258 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2004 | < 10.0.19041.1288 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4704 |
| microsoft | windows server 2019 | < 10.0.17763.2237 |
| microsoft | windows server 2022 | < 10.0.20348.288 |
| microsoft | windows server 20h2 | < 10.0.19042.1288 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40449(US Government Resource)
Weakness Type
CWE-416: Use After Free
In CVE-2021-40449, the Windows Win32k kernel driver contains a use-after-free vulnerability in the NtGdiResetDC function. After a memory object is freed, the driver continues to reference the dangling pointer, and an attacker can manipulate heap memory to place controlled data in the freed region. When the stale pointer is subsequently dereferenced, it executes attacker-controlled code at kernel privilege level.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2021-40449 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting significant local privilege escalation risk. The vulnerability requires local access and low-level authentication (any standard user account), but exploitation complexity is low and no user interaction is needed. Successful exploitation gives the attacker SYSTEM-level privileges, fully compromising confidentiality, integrity, and availability of the affected Windows system. Ransomware usage is known for this vulnerability, meaning threat actors actively incorporate it into ransomware attack chains for privilege escalation after initial access. With an EPSS score of 91.30% (99.7th percentile), CVE-2021-40449 is near-certain to be exploited, and the breadth of affected Windows versions — spanning desktop and server editions from Windows 7 through Windows 11 — means virtually all Windows environments are at risk until patched.
Exploit Maturity
CVE-2021-40449 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-12-01. This vulnerability is known to be used in ransomware campaigns, significantly increasing the urgency of remediation. Public exploit code is available via Packet Storm Security, providing a detailed proof-of-concept for the NtGdiResetDC use-after-free local privilege escalation. The EPSS score of 91.30% (99.7th percentile) indicates near-certain exploitation activity. This vulnerability is commonly used as a post-initial-access privilege escalation step in targeted attack campaigns and ransomware operations.
Remediation
- Apply Microsoft security updates immediately as mandated by CISA KEV: install the October 2021 cumulative updates for all affected Windows versions to address the Win32k use-after-free vulnerability.
- Verify all affected Windows systems have been patched, including: Windows 10 (all builds from 1507 through 21H1), Windows 11 21H2 (prior to build 10.0.22000.258), Windows 7, Windows 8.1, Windows RT 8.1, and all Windows Server versions (2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, and 20H2).
- Implement the principle of least privilege to minimize the number of user accounts with local access, as exploitation requires an authenticated local session. Restrict interactive logon rights to only users who need them.
- Deploy endpoint detection and response (EDR) solutions capable of detecting Win32k exploitation patterns, including suspicious NtGdiResetDC calls, unexpected kernel memory manipulation, and privilege escalation indicators.
- Given the known ransomware association, ensure offline backups are current, network segmentation limits lateral movement, and incident response procedures are ready for rapid containment of potential ransomware deployment.
Technical Details
CVE-2021-40449 is a use-after-free vulnerability in the Windows Win32k kernel-mode driver, specifically in the NtGdiResetDC function. During device context reset operations, a memory object is freed but its pointer remains accessible, creating a dangling reference. An attacker with a local authenticated session can trigger this condition and use heap manipulation techniques (such as heap spraying with controlled kernel objects) to place attacker-controlled data in the freed memory region. When the dangling pointer is dereferenced, the kernel executes attacker-controlled code at ring 0 privilege level. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires local access with low privileges, but achieves full system compromise through kernel-level code execution.
Frequently Asked Questions
Is CVE-2021-40449 being actively exploited?
Yes. CVE-2021-40449 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. Critically, this vulnerability is known to be used in ransomware campaigns, and public exploit code is available. The EPSS score of 91.30% (99.7th percentile) indicates near-certain exploitation.
What products are affected by CVE-2021-40449?
CVE-2021-40449 affects virtually all supported Windows versions including Windows 7, 8.1, 10 (all builds from 1507 through 21H1), Windows 11 21H2, and Windows Server 2008 through 2022. Both desktop and server editions are vulnerable.
How do I fix CVE-2021-40449?
Apply the October 2021 Microsoft security updates for all affected Windows systems. Prioritize patching due to known ransomware usage. As defense-in-depth, implement least privilege policies, deploy EDR solutions, and ensure offline backups are current.
How severe is CVE-2021-40449?
CVE-2021-40449 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local authenticated access, the vulnerability enables full SYSTEM-level privilege escalation. Its confirmed use in ransomware campaigns and the near-certain exploitation probability (EPSS 91.30%) make it a critical priority for patching.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.