All vulnerabilities
CVE-2021-33739

Windows: Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationExploited in the wildAdded to KEV 3 Nov 2021CISA KEV
Exploit odds (EPSS)6.55%Chance of exploitation activity in the next 30 days, higher than 93% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.18363.1621Also 10.0.19043.1052, 10.0.19041.1052 and 1 moreCVE List
Federal deadline17 Nov 2021Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 10.0.18363.1621Windows 10 Version 1909CVE List
  • 10.0.19043.1052Windows 10 Version 21H1CVE List
  • 10.0.19041.1052Windows 10 Version 2004CVE List
  • 10.0.19041.1052Windows Server version 2004CVE List
  • 10.0.19042.1052Windows 10 Version 20H2CVE List
  • 10.0.19042.1052Windows Server version 20H2CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 8 Jun 2021, 22:46 UTCPublishedCVE List
  2. 3 Nov 2021Added to CISA KEVCISA KEV

Description

Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.

Text from CVE List

Affected versions 6

  • Windows 10 Version 1909affected: 10.0.0 before 10.0.18363.1621CVE List
  • Windows 10 Version 21H1affected: 10.0.0 before 10.0.19043.1052CVE List
  • Windows 10 Version 2004affected: 10.0.0 before 10.0.19041.1052CVE List
  • Windows Server version 2004affected: 10.0.0 before 10.0.19041.1052CVE List
  • Windows 10 Version 20H2affected: 10.0.0 before 10.0.19042.1052CVE List
  • Windows Server version 20H2affected: 10.0.0 before 10.0.19042.1052CVE List

References 3