CVE-2021-40449

Microsoft Windows Win32k Privilege Escalation Vulnerability

Published Oct 12, 2021 · updated Jun 16, 2026 · microsoft windows 10 1507

Unspecified vulnerability allows for an authenticated user to escalate privileges.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Detection, updates, and resolution for this record.

Oct 12, 2021 · Catalog
Detected
Unspecified vulnerability allows for an authenticated user to escalate privileges.
Nov 17, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Dec 1, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Unspecified vulnerability allows for an authenticated user to escalate privileges.

Apply updates per vendor instructions.

CISA due date Dec 1, 2021

CISA KEVConfirmed exploitationCVE-2021-40449
Unspecified vulnerability allows for an authenticated user to escalate privileges.
cisa.gov
CVE.orgVulnerability recordCVE-2021-40449
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2021-40449
30-day exploitation probability 74.1%
first.org
Metasploit ModulesPublic exploit moduleexploit_windows/local/cve_2021_40449
Public module reference (good). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2021-40449
Win32k Elevation of Privilege Vulnerability
nvd.nist.gov
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com