All vulnerabilities
CVE-2021-41357

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32kOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 25 Apr 2022CISA KEV
Exploit odds (EPSS)1.58%Chance of exploitation activity in the next 30 days, higher than 75% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.19043.1288Also 10.0.20348.288, 10.0.19041.1288 and 2 moreCVE List
Federal deadline16 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 10.0.19043.1288Windows 10 Version 21H1CVE List
  • 10.0.20348.288Windows Server 2022CVE List
  • 10.0.19041.1288Windows 10 Version 2004CVE List
  • 10.0.19041.1288Windows Server version 2004CVE List
  • 10.0.19042.1288Windows 10 Version 20H2CVE List
  • 10.0.19042.1288Windows Server version 20H2CVE List
Show all 7 fixed versions
  • 10.0.22000.258Windows 11 version 21H2CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 13 Oct 2021, 00:28 UTCPublishedCVE List
  2. 25 Apr 2022Added to CISA KEVCISA KEV

Description

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Text from CVE List

Affected versions 7

  • Windows 10 Version 21H1affected: 10.0.0 before 10.0.19043.1288CVE List
  • Windows Server 2022affected: 10.0.0 before 10.0.20348.288CVE List
  • Windows 10 Version 2004affected: 10.0.0 before 10.0.19041.1288CVE List
  • Windows Server version 2004affected: 10.0.0 before 10.0.19041.1288CVE List
  • Windows 10 Version 20H2affected: 10.0.0 before 10.0.19042.1288CVE List
  • Windows Server version 20H2affected: 10.0.0 before 10.0.19042.1288CVE List
  • Windows 11 version 21H2affected: 10.0.0 before 10.0.22000.258CVE List

References 3