CVE-2021-31955

CVE-2021-31955 is an information disclosure flaw in the Windows kernel (CWE-497) that leaks sensitive kernel information to a locally running attacker. It is triggered by executing a malicious, specially crafted application on an affected Windows system; the attack vector is local, requires only low privileges, and needs no user interaction. Successful exploitation gives the attacker access to sensitive system information (high confidentiality impact), which is typically valuable for reconnaissance or as part of a chained attack with other kernel bugs. Organizations running Windows 10 versions 1809 through 21H1 and Windows Server 2019/2004/20H2 prior to the June 2021 security updates are affected. The flaw was exploited in the wild — Microsoft fixed it among six actively exploited zero-days in June 2021 Patch Tuesday, CISA added it to the KEV catalog on 2021-11-03, and EPSS assigns it an 81.1% probability of exploitation within 30 days.

What to do: Apply the June 2021 Windows cumulative security updates per vendor instructions to Windows 10 (1809, 1909, 2004, 20H2, 21H1) and Windows Server 2019/2004/20H2, then verify affected devices are running updated builds. Because this flaw was exploited in the wild and is on CISA's KEV list, patch it on a priority timeline and check for signs of local malicious code execution. Where patching is delayed, limit local code execution on affected hosts and prioritize internet-exposed servers.