CVE-2021-36958: Windows Print Spooler Remote Code Execution Vulnerability

Overview

Severity: High (CVSS 7.8)
CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Category: Remote Code Execution
Exploit Status: Not Exploited
Exploitation Likelihood: More Likely
Publicly Disclosed: Yes
Patch Tuesday: 2021-Aug
Released: 2021-08-11
Last Updated: 2021-09-14
EPSS Score: 4.71% (percentile: 89.4%)

Description

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

FAQ

When will Microsoft release a security update for this vulnerability? Update: September 14, 2021 - We have completed the investigation and have released the September 2021 security updates to address this vulnerability. Please see the Security Updates table. What versions of Windows are affected by this vulnerability? Update: September 14, 2021 - The September 2021 security updates are now available to address this vulnerability. Please see the Security Updates table for the versions of Windows that are affected.

Affected Products (40)

Other

11568
11569
11570
11571
11572
11712
11713
11714
11896
11897
11898
11766
11767
11768
11769
11800
11801
11802
11803
10729
10735
10852
10853
10816
10855
10047
10048
10481
10482
10484
9312
10287
9318
9344
10051
10049
10378
10379
10483
10543

Security Updates (13)

Acknowledgments

<a href="https://twitter.com/offenseindepth">Victor Mata</a> of FusionX, Accenture Security

Revision History

2021-08-11: Information published.
2021-09-14: CVE updated to announce that Microsoft is releasing the September 2021 security updates for all affected versions of Windows to address this vulnerability. Additionally, other information has been updated, including the following: 1) Executive Summary has been updated. 2) Workarounds have been removed as they are no longer applicable. 3) FAQs have been updated to reflect the release of the September 2021 security updates. 4) CVSS Vector String has been updated.