PT-2021-4388 · Microsoft · Windows+1

Boris Larin + 1 · Published 2021-10-12 · Updated 2025-11-30 · CVE-2021-40449

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Win32k versions prior to the fixed version

Description The issue is related to a use-after-free vulnerability in the Win32k component of Windows operating systems. This vulnerability can be exploited to elevate privileges. The vulnerability is associated with the NtGdiResetDC function of the Win32k driver.

Recommendations As a temporary workaround, consider restricting access to the Win32k driver until a patch is available. Apply the patch provided by Microsoft for the Win32k Elevation of Privilege Vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2021-05018

CVE-2021-40449

Affected Products

Win32K

Windows

References · 50

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2021_40449.rb · Exploit
• 🔥 https://github.com/ly4k/CallbackHell · Exploit
• 🔥 https://github.com/ollypwn/CallbackHell · Exploit
• 🔥 https://github.com/KaLendsi/CVE-2021-40449-Exploit · Exploit
• 🔥 https://github.com/SamuelTulach/voidmap · Exploit
• 🔥 https://github.com/Kristal-g/CVE-2021-40449_poc · Exploit
• 🔥 https://github.com/hakivvi/CVE-2021-40449 · Exploit
• 🔥 https://github.com/BL0odz/CVE-2021-40449-NtGdiResetDC-UAF · Exploit
• 🔥 http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-40449 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05018 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40449 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-40449 · Vendor Advisory