CVE-2021-40450
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2021-40450 is a privilege escalation vulnerability in Microsoft Win32k, the Windows kernel-mode driver responsible for handling graphical user interface operations and window management. This unspecified vulnerability allows a local attacker with standard user access to elevate their privileges on the affected system, potentially gaining SYSTEM-level control. CISA has added CVE-2021-40450 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022, confirming active exploitation in targeted attacks. The EPSS percentile of approximately 92% indicates a very high probability of exploitation, reflecting the maturity and reliability of Win32k exploitation techniques.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.2237 |
| microsoft | windows 10 1909 | < 10.0.18363.1854 |
| microsoft | windows 10 2004 | < 10.0.19041.1288 |
| microsoft | windows 10 20h2 | < 10.0.19042.1288 |
| microsoft | windows 10 21h1 | < 10.0.19043.1288 |
| microsoft | windows 11 21h2 | < 10.0.22000.258 |
| microsoft | windows server 2004 | < 10.0.19041.1288 |
| microsoft | windows server 2019 | < 10.0.17763.2237 |
| microsoft | windows server 2022 | < 10.0.20348.288 |
| microsoft | windows server 20h2 | < 10.0.19042.1288 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40450(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40450(US Government Resource)
Weakness Type
Privilege Escalation in Win32k
The vulnerability in Microsoft Win32k involves an unspecified flaw in the kernel-mode driver responsible for window management and GDI operations. Win32k operates at the kernel privilege level and handles complex user-mode requests, where defects in object lifecycle management, callback handling, or system call processing can be exploited by local attackers to execute arbitrary code with SYSTEM privileges.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2021-40450 requires local access to the target Windows system, but no special privileges beyond a standard user account are needed to exploit the vulnerability. Once exploitation is successful, the attacker gains SYSTEM-level privileges, providing unrestricted access to the entire operating system including all files, registry keys, processes, and services. This level of access enables the attacker to disable security software, install persistent backdoors, exfiltrate sensitive data, and pivot to other systems on the network. The EPSS percentile of approximately 92% confirms very high exploitation probability, and CISA's KEV listing validates that threat actors are actively using this Win32k vulnerability in real-world operations, typically as part of post-compromise escalation chains following initial access through phishing or remote exploitation.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-40450 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 92% indicates very high exploitation activity, consistent with the long history of Win32k vulnerabilities being reliably exploitable for privilege escalation. Win32k has been one of the most frequently targeted kernel components due to its large attack surface and the availability of well-understood exploitation techniques, making CVE-2021-40450 a high-confidence exploitation target for sophisticated threat actors.
Remediation
-
Apply Microsoft security updates immediately as directed by CISA: "Apply updates per vendor instructions." Install the relevant Windows security patch that addresses the Win32k privilege escalation on all affected Windows versions through Windows Update or WSUS.
-
Audit Windows environments for unpatched systems using vulnerability scanning tools and verify patch compliance across all managed endpoints. Focus on systems that may have been excluded from standard patch cycles, including offline machines and specialized workstations.
-
Enforce least privilege access controls to limit the impact of privilege escalation attacks. Remove unnecessary local administrator access, implement application whitelisting, and use Group Policy to restrict access to sensitive system resources and Win32k-related functionality.
-
Deploy advanced endpoint protection including EDR solutions that monitor for kernel-level exploitation patterns, particularly Win32k callback abuse, GDI object manipulation, and unexpected transitions from standard user context to SYSTEM-level processes.
-
Implement network segmentation and lateral movement controls to contain the impact of successful privilege escalation. Deploy micro-segmentation, enforce multi-factor authentication for all privileged access, and restrict inter-system communication to known-good traffic patterns.
Technical Details
CVE-2021-40450 is a privilege escalation vulnerability in Microsoft's Win32k kernel-mode driver, which manages window creation and destruction, message passing, input device handling, and GDI graphics operations for the Windows operating system. The unspecified nature of the vulnerability indicates a flaw in Win32k's internal processing logic that allows a locally authenticated attacker with standard user privileges to execute arbitrary code at the kernel privilege level. Win32k vulnerabilities of this nature typically involve use-after-free conditions, type confusion in object handling, or race conditions during callback processing, where the attacker can manipulate kernel data structures to redirect execution flow to attacker-controlled code. The local attack vector means this vulnerability serves as a privilege escalation stage in multi-step attacks, converting limited user access into full SYSTEM control.
Frequently Asked Questions
Is CVE-2021-40450 being actively exploited?
Yes, CVE-2021-40450 is being actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 92% confirms very high exploitation probability.
What products are affected by CVE-2021-40450?
CVE-2021-40450 affects Microsoft Windows systems that include the Win32k kernel-mode driver. Multiple Windows versions are impacted. All Windows installations that have not applied the corresponding security update are vulnerable to this privilege escalation.
How do I fix CVE-2021-40450?
Apply the Microsoft security update addressing the Win32k vulnerability on all affected Windows systems through Windows Update or WSUS. Enforce least privilege access controls and deploy EDR solutions capable of detecting kernel-level exploitation patterns.
How severe is CVE-2021-40450?
CVE-2021-40450 is a high-severity privilege escalation vulnerability with an EPSS percentile of approximately 92%. While local access is required, the Win32k flaw grants SYSTEM-level privileges and is actively used in post-compromise attack chains by sophisticated threat actors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.