PT-2021-3092 · Microsoft · Http Protocol Stack+1
Published
2021-05-11
·
Updated
2026-01-10
·
CVE-2021-31166
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft HTTP Protocol Stack versions prior to the fixed version
Description
The issue is related to a memory usage problem after memory release in the HTTP Protocol Stack of Microsoft Windows operating systems. This can be exploited by a remote attacker using a specially crafted HTTP request to execute arbitrary code. The vulnerability has a critical threat level and can potentially serve as the basis for creating a network worm. It is estimated that many devices are not updated in a timely manner, which may lead to new attacks based on this issue.
Recommendations
For Microsoft HTTP Protocol Stack versions prior to the fixed version, update to the latest version to resolve the issue.
As a temporary workaround, consider restricting access to the HTTP protocol stack to minimize the risk of exploitation.
Avoid using the vulnerable HTTP protocol stack until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Http Protocol Stack
Windows