CVE-2021-34466: Windows Hello Security Feature Bypass Vulnerability

Overview

Severity

Medium (CVSS 5.7)

CVSS Vector

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

Category

Security Feature Bypass

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2021-Jul

Released

2021-07-13

Last Updated

2021-08-04

EPSS Score

0.44% (percentile: 63.3%)

FAQ

Where can I find more information about Windows Hello Face Authentication? Please see Windows Hello Face Authentication for updated details. Where can I find more information about this vulnerability? Please see KB5005478 - Windows Hello CVE-2021-34466 for more details.

Affected Products (15)

Windows

• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows 10 Version 2004 for ARM64-based Systems
• Windows 10 Version 2004 for x64-based Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for ARM64-based Systems

Security Updates (3)

• 5004244
• 5004245
• 5004237

Acknowledgments

Omer Tsarfati, CyberArk Labs, https://labs.cyberark.com

Revision History

• 2021-07-13: Information published.
• 2021-08-04: Updated FAQ information. This is an informational change only.