CVE-2021-41379

CVE-2021-41379 is an elevation of privilege flaw in the Microsoft Windows Installer service, rooted in improper link resolution before file access (CWE-59), where the privileged installer can be made to follow attacker-controlled file links. It is triggered by a local, low-privileged user who initiates a Windows Installer operation and manipulates the links or paths the installer resolves while running with elevated rights. A successful attacker gains elevated (SYSTEM-level) privileges on the affected machine, a common post-breach step in ransomware chains. The affected list spans essentially the entire supported Windows install base: Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H1, Windows 11 21H2, and Windows Server 2004. Exploitation is confirmed in the wild - CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-03-03 with known ransomware use, and EPSS places it in the 97th percentile (19.4% probability of exploitation in 30 days) despite no public PoC being known.

What to do: Apply Microsoft's security update for CVE-2021-41379 (delivered via the November 2021 monthly Windows cumulative updates) to all affected Windows 7/8.1/RT 8.1/10/11 and Windows Server systems and keep cumulative updates current. Because CISA's KEV entry cites known ransomware use and the flaw is exploitable by any local standard user, prioritize patching multi-user hosts, servers, and endpoints that allow standard (non-admin) logons; as an interim mitigation, restrict local logon rights on unpatched machines and ensure users operate without administrative privileges.