<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p><strong>UPDATE</strong> August 10, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. This security update changes the Point and Print default behavior; please see <a href="https://support.microsoft.com/help/5005652">KB5005652</a>.</p>

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.30553.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Microsoft Windows 10 Version 1809 affected
Version Status Constraints
10.0.0 affected < 10.0.17763.2114
Microsoft Windows Server 2019 affected
Version Status Constraints
10.0.0 affected < 10.0.17763.2114
Microsoft Windows Server 2019 (Server Core installation) affected
Version Status Constraints
10.0.0 affected < 10.0.17763.2114
Microsoft Windows 10 Version 1909 affected
Version Status Constraints
10.0.0 affected < 10.0.18363.1734
Microsoft Windows 10 Version 21H1 affected
Version Status Constraints
10.0.0 affected < 10.0.19043.1165
Microsoft Windows 10 Version 2004 affected
Version Status Constraints
10.0.0 affected < 10.0.19041.1165
Microsoft Windows Server version 2004 affected
Version Status Constraints
10.0.0 affected < 10.0.19041.1165
Microsoft Windows 10 Version 20H2 affected
Version Status Constraints
10.0.0 affected < 10.0.19042.1165
Microsoft Windows Server version 20H2 affected
Version Status Constraints
10.0.0 affected < 10.0.19042.1165
Microsoft Windows 10 Version 1507 affected
Version Status Constraints
10.0.0 affected < 10.0.10240.19022
Microsoft Windows 10 Version 1607 affected
Version Status Constraints
10.0.0 affected < 10.0.14393.4583
Microsoft Windows Server 2016 affected
Version Status Constraints
10.0.0 affected < 10.0.14393.4583
Microsoft Windows Server 2016 (Server Core installation) affected
Version Status Constraints
10.0.0 affected < 10.0.14393.4583
Microsoft Windows 7 affected
Version Status Constraints
6.1.0 affected < 6.1.7601.25685
Microsoft Windows 7 Service Pack 1 affected
Version Status Constraints
6.1.0 affected < 6.1.7601.25685
Microsoft Windows 8.1 affected
Version Status Constraints
6.3.0 affected < 6.3.9600.20094
Microsoft Windows Server 2008 Service Pack 2 affected
Version Status Constraints
6.0.0 affected < 6.0.6003.21192
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) affected
Version Status Constraints
6.0.0 affected < 6.0.6003.21192
Microsoft Windows Server 2008 Service Pack 2 affected
Version Status Constraints
6.0.0 affected < 6.0.6003.21192
Microsoft Windows Server 2008 R2 Service Pack 1 affected
Version Status Constraints
6.1.0 affected < 6.1.7601.25685
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) affected
Version Status Constraints
6.0.0 affected < 6.1.7601.25685
Microsoft Windows Server 2012 affected
Version Status Constraints
6.2.0 affected < 6.2.9200.23435
Microsoft Windows Server 2012 (Server Core installation) affected
Version Status Constraints
6.2.0 affected < 6.2.9200.23435
Microsoft Windows Server 2012 R2 affected
Version Status Constraints
6.3.0 affected < 6.3.9600.20094
Microsoft Windows Server 2012 R2 (Server Core installation) affected
Version Status Constraints
6.3.0 affected < 6.3.9600.20094

Configuration 1 [-]

OR cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Microsoft Subscribe
Windows 10 Subscribe
Windows 10 1507 Subscribe
Windows 10 1607 Subscribe
Windows 10 1809 Subscribe
Windows 10 1909 Subscribe
Windows 10 20h2 Subscribe
Windows 10 21h1 Subscribe
Windows 7 Subscribe
Windows 8.1 Subscribe
Windows Rt 8.1 Subscribe
Windows Server 2004 Subscribe
Windows Server 2008 Subscribe
Windows Server 2008 R2 Subscribe
Windows Server 2008 Sp2 Subscribe
Windows Server 2012 Subscribe
Windows Server 2012 R2 Subscribe
Windows Server 2016 Subscribe
Windows Server 2019 Subscribe
Windows Server 20h2 Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34481 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2024-08-04T00:12:50.369Z

Reserved: 2021-06-09T00:00:00

Link: CVE-2021-34481

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-07-16T21:15:10.133

Modified: 2024-11-21T06:10:30.303

Link: CVE-2021-34481

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses