CVE-2021-41357
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2021-41357 is a privilege escalation vulnerability in Microsoft Win32k, a core Windows kernel-mode driver that handles graphical user interface operations. This unspecified vulnerability in Win32k allows a local attacker to elevate their privileges, potentially gaining SYSTEM-level access and complete control over the affected Windows system. CISA has added CVE-2021-41357 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022, confirming that this Win32k privilege escalation flaw has been actively exploited in the wild. The EPSS percentile of approximately 92% indicates a very high probability of exploitation, making this a critical patch priority for Windows environments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 2004 | < 10.0.19041.1288 |
| microsoft | windows 10 20h2 | < 10.0.19042.1288 |
| microsoft | windows 10 21h1 | < 10.0.19043.1288 |
| microsoft | windows 11 21h2 | < 10.0.22000.258 |
| microsoft | windows server 2004 | < 10.0.19041.1288 |
| microsoft | windows server 2022 | < 10.0.20348.288 |
| microsoft | windows server 20h2 | < 10.0.19042.1288 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41357(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41357(US Government Resource)
Weakness Type
Privilege Escalation in Win32k
The vulnerability in Microsoft Win32k involves an unspecified flaw in the kernel-mode driver that handles window management and graphical operations. Win32k processes user-mode requests at the kernel privilege level, and defects in object handling, input validation, or memory management within Win32k can allow a local attacker to execute arbitrary code in kernel mode, achieving SYSTEM-level privileges.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2021-41357 requires local access to the target system, meaning an attacker must first establish a presence on the Windows machine before exploiting this vulnerability. Once local access is obtained, no special privileges beyond a standard user account are needed to trigger the Win32k privilege escalation. Successful exploitation grants the attacker SYSTEM-level privileges, the highest privilege level on Windows, enabling complete control over the operating system including access to all data, modification of security settings, installation of persistent backdoors, and creation of new administrative accounts. The EPSS percentile of approximately 92% indicates very high exploitation activity, and CISA's KEV catalog listing confirms that threat actors are actively leveraging this Win32k vulnerability in real-world attack campaigns, typically as part of multi-stage attack chains where initial access is obtained through separate vulnerabilities or social engineering.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-41357 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 92% indicates very high exploitation activity, placing this vulnerability among the most actively exploited Windows kernel flaws. Win32k privilege escalation vulnerabilities are consistently favored by threat actors due to their reliability and the critical level of access they provide, making CVE-2021-41357 a valuable tool in post-compromise attack chains.
Remediation
-
Apply Microsoft security updates immediately as directed by CISA: "Apply updates per vendor instructions." Install the Windows security patch addressing the Win32k privilege escalation vulnerability on all affected Windows systems through Windows Update, WSUS, or Microsoft Update Catalog.
-
Prioritize patching for externally accessible systems including servers, remote desktop hosts, and systems accessible through VPN or other remote access solutions, as these are the most likely targets for multi-stage attacks involving privilege escalation.
-
Implement least privilege principles to minimize the impact of privilege escalation. Remove unnecessary local administrator access, restrict User Account Control (UAC) bypass techniques through Group Policy, and deploy application control to prevent unauthorized code execution.
-
Monitor for Win32k exploitation indicators by enabling advanced kernel event auditing, deploying endpoint detection and response (EDR) solutions capable of detecting kernel-level exploitation, and configuring alerts for unexpected SYSTEM-level process creation from standard user sessions.
-
Harden Windows systems against post-exploitation by implementing Credential Guard, restricting NTLM authentication, enabling Attack Surface Reduction (ASR) rules, and deploying network segmentation to limit lateral movement following privilege escalation.
Technical Details
CVE-2021-41357 is a privilege escalation vulnerability in Microsoft's Win32k kernel-mode driver, which is responsible for graphical operations including window management, input handling, and GDI operations within the Windows operating system. The unspecified vulnerability allows a locally authenticated attacker to exploit a flaw in Win32k's processing of certain system calls or object operations to execute arbitrary code in kernel mode. Because Win32k operates at ring 0 (kernel privilege level), successful exploitation immediately grants SYSTEM privileges, bypassing all user-mode security controls including UAC and process-level access controls. The local attack vector means this vulnerability is primarily used as a privilege escalation component in multi-stage attacks, where an attacker first gains initial access through a remote vector and then uses Win32k exploitation to achieve full system control.
Frequently Asked Questions
Is CVE-2021-41357 being actively exploited?
Yes, CVE-2021-41357 is being actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 92% confirms very high exploitation activity.
What products are affected by CVE-2021-41357?
CVE-2021-41357 affects Microsoft Windows systems that use the Win32k kernel-mode driver. Multiple Windows versions are impacted. All Windows installations that have not applied the corresponding security update remain vulnerable to this privilege escalation.
How do I fix CVE-2021-41357?
Apply the Microsoft security update that addresses the Win32k vulnerability on all affected Windows systems. Implement least privilege access controls and deploy EDR solutions to detect exploitation attempts. Prioritize patching for externally accessible systems.
How severe is CVE-2021-41357?
CVE-2021-41357 is a high-severity privilege escalation vulnerability with an EPSS percentile of approximately 92%. While local access is required, the vulnerability grants SYSTEM-level privileges and is actively used in multi-stage attack chains by threat actors targeting Windows environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.