What is CVE-2021-34516?

CVE-2021-34516 is a high-severity software vulnerability (Improper input validation) with a CVSS score of 7.8. Win32k Elevation of Privilege Vulnerability

Is CVE-2021-34516 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 1%.

What products does CVE-2021-34516 affect?

Tracked products affected include Windows 10, Windows Server 2016, Windows Server 2019. Check the version you run to see whether it is affected.

How do I fix CVE-2021-34516?

Apply the vendor fix promptly. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2021-34516

HIGH severity · CVSS 7.8 · Improper input validation

7.8CVSS HIGH

Summary

Win32k Elevation of Privilege Vulnerability

Impact & exploitability

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)1%

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products we track (3)

Windows 10 Windows Server 2016 Windows Server 2019

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34516 ↗

Additional information

NVD record
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34516Patch
https://www.zerodayinitiative.com/advisories/ZDI-21-1004/Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1005/Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1006/Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1007/Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1008/Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1009/Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1010/Advisory