CVE-2021-31956

Microsoft Windows NTFS contains a privilege escalation flaw in which improper handling of integer underflow/overflow (CWE-191) leads to an out-of-bounds write (CWE-787), exploitable via a specially crafted application. A local attacker who can run such an application on a vulnerable Windows system can trigger the flaw and gain elevated privileges on that host. Because the flaw resides in the file system component shipped with Windows, essentially all supported Microsoft Windows releases are in scope. Exploitation is confirmed in the wild: CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a required action to apply vendor updates, though ransomware usage is unknown and no public proof-of-concept is cataloged. Predictive scoring (EPSS) places the 30-day exploitation probability at 22.3% (98th percentile).

What to do: Apply Microsoft security updates on all Windows systems per vendor instructions; this flaw was remediated in Microsoft's June 2021 monthly security (cumulative) updates, so verify each Windows build's installed cumulative update level against the Microsoft advisory. Prioritize patching multi-user and shared systems (terminal/RDS servers, kiosks, shared workstations) where local attackers can run untrusted code. As interim mitigation, restrict execution of untrusted local applications on vulnerable hosts.