Every CVE Search/ Get API key

CVE-2021-40449

Win32k Elevation of Privilege Vulnerability

7.8 HighIn KEVPublic exploit

Win32k Elevation of Privilege Vulnerability

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

81.9%Up 81.5 points since Oct 13, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.8

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Record
CVE-2021-40449
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2021-27626 7.8

Win32k Elevation of Privilege Vulnerability

Record
EUVD-2021-27626
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-qjf4-g2gg-w6pq 7.8

Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021...

Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.

Record
GHSA-qjf4-g2gg-w6pq
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269, CWE-416
Updated
2026-11-02
CISA KEV No score

Microsoft Windows Win32k Privilege Escalation Vulnerability

Unspecified vulnerability allows for an authenticated user to escalate privileges.

Record
CVE-2021-40449
Weakness
CWE-416
Updated
2026-11-02
NVD 7.8

Win32k Elevation of Privilege Vulnerability

Record
CVE-2021-40449
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-416
Updated
2026-11-02

Affected products

Show 29 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitWin32k NtGdiResetDC Use After Free Local Privilege Elevation2021-10-12
PoC in GitHubly4k/CallbackHell2021-10-16
PoC in GitHubKaLendsi/CVE-2021-40449-Exploit2021-10-20
PoC in GitHubhakivvi/CVE-2021-404492021-10-25
PoC in GitHubKristal-g/CVE-2021-40449_poc2021-11-07
PoC in GitHubCppXL/cve-2021-40449-poc2021-11-12
PoC in GitHubBL0odz/CVE-2021-40449-NtGdiResetDC-UAF2022-02-20
PoC in GitHubSamuelTulach/voidmap2022-03-04

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-40449 is a high vulnerability (CVSS 7.8) in Microsoft Windows, published October 13, 2021. CISA lists it as known to be exploited, since November 17, 2021. EUVD reports exploitation since November 17, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 81.9%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open