CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2021-05-11
Windows HTTP Protocol Stack (HTTP.sys) Use-After-Free Remote Code Execution Vulnerability (CVE-2021-31166) Analysis and Mitigation Guide
[Affected Scope] HTTP.sys services running on Windows 10 versions 2004, 20H2 and Windows Server versions 2004, 20H2
[Impact] Unauthenticated remote attackers can execute arbitrary code in the kernel context or trigger an immediate Blue Screen of Death (BSOD) leading to Denial of Service (DoS) by sending specially crafted HTTP packets
[Mitigation] Apply the official Microsoft cumulative security updates immediately, and restrict external exposure of HTTP.sys-dependent services prior to patching