Read the docs
TI-2021-18181 Aliases CVE-2021-41357GHSA-pph6-grp2-wvvw

Win32k Elevation of Privilege Vulnerability

Priority CRITICAL 93Exploited in the wildPublished · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Win32k Elevation of Privilege Vulnerability

Why it matters now

Exploitation Active In CISA KEV since 2022-04-25CISA due date 2022-05-16
EPSS 0.01582 75th percentileScored 2026-11-07
Fix Fixed Windows 10 Version 21H1 (Microsoft): 10.0.19043.1288Windows Server 2022 (Microsoft): 10.0.20348.288+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftWindows 10 Version 21H110.0.0 to before 10.0.19043.128810.0.19043.1288Patch availableCNA
MicrosoftWindows Server 202210.0.0 to before 10.0.20348.28810.0.20348.288Patch availableCNA
MicrosoftWindows 10 Version 200410.0.0 to before 10.0.19041.128810.0.19041.1288Patch availableCNA
MicrosoftWindows Server version 200410.0.0 to before 10.0.19041.128810.0.19041.1288Patch availableCNA
MicrosoftWindows 10 Version 20H210.0.0 to before 10.0.19042.128810.0.19042.1288Patch availableCNA
MicrosoftWindows Server version 20H210.0.0 to before 10.0.19042.128810.0.19042.1288Patch availableCNA
MicrosoftWindows 11 version 21H210.0.0 to before 10.0.22000.25810.0.22000.258Patch availableCNA
  • Windows 10 Version 21H1 VendorMicrosoft Affected 10.0.0 to before 10.0.19043.1288 Fixed in 10.0.19043.1288 Patch available CNA
  • Windows Server 2022 VendorMicrosoft Affected 10.0.0 to before 10.0.20348.288 Fixed in 10.0.20348.288 Patch available CNA
  • Windows 10 Version 2004 VendorMicrosoft Affected 10.0.0 to before 10.0.19041.1288 Fixed in 10.0.19041.1288 Patch available CNA
  • Windows Server version 2004 VendorMicrosoft Affected 10.0.0 to before 10.0.19041.1288 Fixed in 10.0.19041.1288 Patch available CNA
  • Windows 10 Version 20H2 VendorMicrosoft Affected 10.0.0 to before 10.0.19042.1288 Fixed in 10.0.19042.1288 Patch available CNA
  • Windows Server version 20H2 VendorMicrosoft Affected 10.0.0 to before 10.0.19042.1288 Fixed in 10.0.19042.1288 Patch available CNA
  • Windows 11 version 21H2 VendorMicrosoft Affected 10.0.0 to before 10.0.22000.258 Fixed in 10.0.22000.258 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*before 10.0.19041.1288VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*before 10.0.19042.1288VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*before 10.0.19043.1288VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*before 10.0.22000.258VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*before 10.0.19041.1288VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*before 10.0.20348.288VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*before 10.0.19042.1288VulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:* Versions before 10.0.19041.1288 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:* Versions before 10.0.19042.1288 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:* Versions before 10.0.19043.1288 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* Versions before 10.0.22000.258 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:* Versions before 10.0.19041.1288 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* Versions before 10.0.20348.288 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:* Versions before 10.0.19042.1288 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Windows 10 Version 21H1 (Microsoft) Fixed in 10.0.19043.1288
  • Fix · CNA Windows Server 2022 (Microsoft) Fixed in 10.0.20348.288
  • Fix · CNA Windows 10 Version 2004 (Microsoft) Fixed in 10.0.19041.1288
  • Fix · CNA Windows Server version 2004 (Microsoft) Fixed in 10.0.19041.1288
  • Fix · CNA Windows 10 Version 20H2 (Microsoft) Fixed in 10.0.19042.1288
  • Fix · CNA Windows Server version 20H2 (Microsoft) Fixed in 10.0.19042.1288
  • Fix · CNA Windows 11 version 21H2 (Microsoft) Fixed in 10.0.22000.258

Timeline

  1. 2022-04-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-41357
  3. 2026-10-03 Alias added: GHSA-pph6-grp2-wvvw

References

Patch 1

  • TI-2021-11386 HTTP Protocol Stack Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17496 Microsoft MSHTML Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2021-13480 Scripting Engine Memory Corruption Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2021-13116 Windows MSHTML Platform Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2021-13113 Microsoft DWM Core Library Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 8.4
  • TI-2021-19234 Windows Common Log File System Driver Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 7.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences