CVE-2021-41379
Microsoft Windows Installer Privilege Escalation Vulnerability
Description
CVE-2021-41379 is a medium-severity improper link resolution before file access ('link following') vulnerability affecting Microsoft Windows. Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 1.16% (78.4th percentile), this vulnerability has a notable probability of exploitation. This vulnerability is known to be used in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19119 |
| microsoft | windows 10 1607 | < 10.0.14393.4770 |
| microsoft | windows 10 1809 | < 10.0.17763.2300 |
| microsoft | windows 10 1909 | < 10.0.18363.1916 |
| microsoft | windows 10 2004 | < 10.0.19041.1348 |
| microsoft | windows 10 20h2 | < 10.0.19042.1348 |
| microsoft | windows 10 21h1 | < 10.0.19043.1348 |
| microsoft | windows 11 21h2 | < 10.0.22000.318 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2004 | < 10.0.19041.1348 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4770 |
| microsoft | windows server 2019 | < 10.0.17763.2300 |
| microsoft | windows server 2022 | < 10.0.20348.350 |
| microsoft | windows server 20h2 | < 10.0.19042.1348 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41379(Patch, Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-21-1308/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41379(US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access, commonly known as "Link Following" or "Symlink Attack," occurs when software accesses a file through a path that can be modified by an attacker who creates or manipulates symbolic links (symlinks), hard links, or junctions. The vulnerability arises when a program follows a symbolic link to access a file without verifying that the link points to an intended and authorized location.
Learn more: CWE-59 — Improper Link Resolution Before File Access ('Link Following')
Impact Analysis
CVE-2021-41379 carries a CVSS 3.1 score of 5.5 (MEDIUM), indicating a moderate-severity threat. The vulnerability requires local access to exploit with low attack complexity and requires low-level privileges. Successful exploitation can cause complete service disruption. Organizations running affected Windows deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-41379 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 1.16% (78.4th percentile) indicates a measurable probability of exploitation. This vulnerability has been associated with ransomware campaigns, underscoring the financial and operational risks of delayed patching.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (microsoft windows 10 1507 < 10.0.10240.19119; microsoft windows 10 1607 < 10.0.14393.4770; microsoft windows 10 1809 < 10.0.17763.2300) have been updated to patched versions.
- If immediate patching is not possible, restrict local access to affected systems and enforce principle of least privilege.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2021-41379 affects Microsoft Windows. Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation. The attack vector is local, requiring the attacker to have some form of access to the target system. The CVSS score of 5.5 reflects a moderate vulnerability, but its inclusion in the KEV catalog confirms real-world exploitation risk.
Frequently Asked Questions
Is CVE-2021-41379 being actively exploited?
Yes. CVE-2021-41379 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 1.16% (78.4th percentile) further indicates a measurable exploitation probability. This vulnerability is also known to be used in ransomware campaigns.
What products are affected by CVE-2021-41379?
CVE-2021-41379 affects Microsoft Windows. Specifically affected products include: microsoft windows 10 1507 (< 10.0.10240.19119), microsoft windows 10 1607 (< 10.0.14393.4770), microsoft windows 10 1809 (< 10.0.17763.2300), microsoft windows 10 1909 (< 10.0.18363.1916), microsoft windows 10 2004 (< 10.0.19041.1348).
How do I fix CVE-2021-41379?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2021-41379?
CVE-2021-41379 has a CVSS 3.1 score of 5.5 (MEDIUM). While rated as medium severity, its presence in the KEV catalog confirms it is being actively exploited and should be remediated promptly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.