CVE-2021-34481

Windows Print Spooler Remote Code Execution Vulnerability

Published Jul 16, 2021 CVSS 3.1 · 8.8 High EPSS 47.7% KEV · Not listed
Description
A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
UPDATE August 10, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. This security update changes the Point and Print default behavior; please see KB5005652.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description <p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p><strong>UPDATE</strong> August 10, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. This security update changes the Point and Print default behavior; please see <a href="https://support.microsoft.com/help/5005652">KB5005652</a>.</p> A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. UPDATE August 10, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. This security update changes the Point and Print default behavior; please see KB5005652.
CPEs cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.19022:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.19022:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4583:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.4583:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1734:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1165:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1734:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1734:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1165:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1165:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_7:6.1.7601.25685:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_7:6.1.7601.25685:sp1:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_8.1:6.3.9600.20094:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_8.1:6.3.9600.20094:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_rt_8.1:6.3.9600.20094:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2004:10.0.19041.1165:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25685:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21192:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.21192:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23435:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20094:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.4583:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.2114:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1165:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_20H2:*:*:*:*:*:*:*:*
References
Type Values Removed Values Added
Description <p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p><strong>UPDATE</strong> August 10, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. This security update changes the Point and Print default behavior; please see <a href="https://support.microsoft.com/help/5005652">KB5005652</a>.</p> <p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p><strong>UPDATE</strong> August 10, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. This security update changes the Point and Print default behavior; please see <a href="https://support.microsoft.com/help/5005652">KB5005652</a>.</p>