Actively exploited · Published May 11, 2021 · Assigned by microsoft
CVE-2021-31166HTTP Protocol Stack Remote Code Execution Vulnerability
Critical 9.8 Exploited
In plain English
A critical-severity use-after-free in Windows 10 Version 2004 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on April 6, 2022). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)99.9%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Apr 6, 2022
Attack tooling2Metasploit, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 27, 2022.
Official description
HTTP Protocol Stack Remote Code Execution Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 10 Version 2004 | 10.0.0 – before 10.0.19041.982 |
| Microsoft | Windows Server version 2004 | 10.0.0 – before 10.0.19041.982 |
| Microsoft | Windows 10 Version 20H2 | 10.0.0 – before 10.0.19042.982 |
| Microsoft | Windows Server version 20H2 | 10.0.0 – before 10.0.19042.982 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31166 x_refsource_MISC
- http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote-Code-Execution.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31166 government-resource