CVE-2021-40449

Microsoft's Win32k kernel driver contains a use-after-free (CWE-416) local privilege escalation vulnerability (CVE-2021-40449) affecting Windows client versions from Windows 7 through Windows 11 21H2. A local attacker who can already execute code on a system can trigger the flaw — demonstrated in a public proof of concept via the NtGdiResetDC system call — to corrupt kernel memory and elevate to SYSTEM-level privileges with high impact on confidentiality, integrity, and availability (CVSS 7.8, local vector, no user interaction). Any Windows desktop or laptop running the affected versions is exposed to any unprivileged process or malware that gains a foothold on the device. The bug was exploited as a zero-day in the wild before being fixed; CISA added it to the KEV catalog on 2021-11-17 with known ransomware use, and public reporting ties exploitation to the MysterySnail RAT campaign (including the lightweight MysteryMonoSnail backdoor). EPSS places the flaw in the 99th percentile, with a 74.1% probability of exploitation activity within 30 days.

What to do: Apply Microsoft's security updates addressing this Win32k flaw via Windows Update on all affected Windows 7, 8.1, 10, and 11 clients, per the CISA KEV required action, and verify inventories show no unpatched Windows 10 builds (1507–21H1) or Windows 11 21H2 endpoints. Because this was a zero-day exploited in the wild — including in campaigns involving MysterySnail and ransomware use noted by CISA — treat patching as urgent on all endpoints. Until patched, limit execution of untrusted or unprivileged local code on these systems.