CVE-2021-34447
MediumCVSS 6.8Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
A remote code execution vulnerability in the Windows MSHTML platform allows an attacker to execute arbitrary code in the context of the logged-on user. The attack can be carried out via a specially crafted web page or document.
Risk Assessment
The risk includes full compromise of the user's system, potentially leading to data theft, malware installation, and privilege escalation.
Recommendation
It is recommended to urgently install Windows updates and limit the use of browsers and applications that rely on MSHTML.
Other vulnerabilities in Windows MSHTML
See all- CVE-2024-43461HighActively exploited
A spoofing vulnerability in the Windows MSHTML platform.
- CVE-2023-32046HighActively exploited
Windows MSHTML Platform Elevation of Privilege Vulnerability. Technical details are not provided in the description.
- CVE-2021-34534Medium
Remote code execution vulnerability in Windows MSHTML platform. An attacker could exploit this flaw to run arbitrary code in the context of the logged-on user.
- CVE-2021-34497Medium
Remote code execution vulnerability in Windows MSHTML platform. An attacker could exploit this flaw to run arbitrary code in the context of the logged-on user.
Original NVD description (English source)
Windows MSHTML Platform Remote Code Execution Vulnerability
Vulnerability data from NVD (NIST) · CISA KEV · EPSS