Actively exploited in the wild

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Microsoft - Windows · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2021-34448

MediumCVSS 6.8KEV

Published: 16/07/2021(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

30.67%

98th percentile - higher than 98% of all known CVEs

Summary

Memory corruption vulnerability in the scripting engine. It could allow remote code execution in the context of the logged-in user.

Risk Assessment

An attacker could exploit this vulnerability to take control of the victim's system if they visit a malicious website or open a specially crafted file.

Recommendation

Install the latest security updates from the software vendor.

Original NVD description (English source)

Scripting Engine Memory Corruption Vulnerability