PT-2021-4794 · Microsoft · Windows 11+4

Abdelhamid Naceri · Published 2021-11-09 · Updated 2025-12-25 · CVE-2021-41379

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Installer versions prior to the fixed version

Description The vulnerability is related to an elevation-of-privilege issue in the Windows Installer component, allowing attackers to gain administrative privileges. This issue affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server 2022. The vulnerability was discovered after analyzing a patch for a previously known issue, which was not correctly fixed, leading to the creation of a bypass. An exploit for this vulnerability has been made public, and it has been reported that malicious actors are already using it to create malware. The estimated number of potentially affected devices is not specified, but it is likely to be high given the widespread use of Windows operating systems.

Recommendations For all versions of Microsoft Windows Installer prior to the fixed version: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Link Following

Improper Privilege Management

Weakness Enumeration

CWE-59

CWE-269

Related Identifiers

BDU:2021-05516

CVE-2021-41379

ZDI-21-1308

Affected Products

Windows

Windows 10

Windows 11

Windows Installer

Windows Server 2022

References · 41

• 🔥 https://github.com/jbaines-r7/shakeitoff · Exploit
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41379 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-1308 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41379 · Security Note
• https://bdu.fstec.ru/vul/2021-05516 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/671597 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-41379 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41379 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41379 · Security Note
• https://t.me/hybgl/1157 · Telegram Post
• https://t.me/s_e_reborn/1392 · Telegram Post
• ❌ https://github.com/klinix5/WindowsMDMLPE · Note, Deleted
• https://t.me/poxek/140 · Telegram Post
• https://twitter.com/Raj_Samani/status/1465260944565714945 · Note