PT-2021-4388 · Microsoft · Win32K+1

Boris Larin + 1 · CVE-2021-40449 · Published 2021-10-12 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows 10 1507 versions prior to 10.0.10240.19086 Microsoft Windows 10 1607 versions prior to 10.0.14393.4704 Microsoft Windows 10 1809 versions prior to 10.0.17763.2237 Microsoft Windows 10 1909 versions prior to 10.0.18363.1854 Microsoft Windows 10 2004 versions prior to 10.0.19041.1288

Description An elevation-of-privilege issue exists in the Win32k component (win32kfull.sys) of the Windows operating system. The flaw is caused by a use-after-free condition, which occurs when the kernel invokes user-mode callbacks and incorrectly assumes that an object remains unchanged after the callback returns. An attacker can exploit this by modifying, freeing, or replacing the object to gain elevated privileges on the system.

Recommendations Update Microsoft Windows 10 1507 to version 10.0.10240.19086 or later. Update Microsoft Windows 10 1607 to version 10.0.14393.4704 or later. Update Microsoft Windows 10 1809 to version 10.0.17763.2237 or later. Update Microsoft Windows 10 1909 to version 10.0.18363.1854 or later. Update Microsoft Windows 10 2004 to version 10.0.19041.1288 or later.

Exploit

Fix

LPE

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2021-05018

CVE-2021-40449

Affected Products

Win32K

Windows

References · 51

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2021_40449.rb · Exploit
• 🔥 https://github.com/ly4k/CallbackHell · Exploit
• 🔥 https://github.com/ollypwn/CallbackHell · Exploit
• 🔥 https://github.com/KaLendsi/CVE-2021-40449-Exploit · Exploit
• 🔥 https://github.com/SamuelTulach/voidmap · Exploit
• 🔥 https://github.com/Kristal-g/CVE-2021-40449_poc · Exploit
• 🔥 https://github.com/hakivvi/CVE-2021-40449 · Exploit
• 🔥 https://github.com/BL0odz/CVE-2021-40449-NtGdiResetDC-UAF · Exploit
• 🔥 http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-40449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40449 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/670473 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05018 · Security Note