CVE-2021-1732: Microsoft Windows Win32k out-of-bounds write privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a patched but actively exploited local privilege escalation flaw in CISA KEV with known ransomware use and very high EPSS, though it requires an existing local foothold.

What it is

CVE-2021-1732 is an out-of-bounds write (CWE-787) in the Windows Win32k component that allows a local user to elevate privileges. It affects multiple Windows 10 and Windows Server builds, and Microsoft released a patch in February 2021. Because it is a kernel-level elevation flaw with public exploit code and confirmed in-the-wild use, it is a serious risk on unpatched systems.

Impact

A local attacker who can run code on a target can exploit the out-of-bounds write to gain SYSTEM-level privileges. That access can then be used to disable defenses, install persistence, or move laterally.

Attack surface

The flaw is reached locally through the Win32k subsystem, requiring the attacker to already have code execution or an interactive session on the host. No user interaction is needed beyond that local access, and the CVSS vector (AV:L/PR:L/UI:N) confirms a low-privileged local user is sufficient.

Exploitation

CVE-2021-1732 is listed in CISA KEV with a due date of 2021-11-17 and is flagged for known ransomware campaign use; EPSS is 0.78376 (99.6th percentile). Public exploit code is referenced on Packet Storm, so exploitation is both practical and observed.

What to do

• Apply the Microsoft security update for CVE-2021-1732 on all affected Windows 10 and Windows Server builds.
• Prioritize patching internet-facing and high-value systems, and verify patch status across the listed product versions.
• Restrict local interactive logon and code execution to trusted users, since the flaw requires a local foothold.
• Enable and monitor endpoint detection for privilege escalation and suspicious Win32k activity.
• Review KEV remediation tracking to confirm all affected assets meet the required action.

Detection

• Monitor for processes spawning with SYSTEM integrity from non-system parent processes, especially after user-level execution.
• Look for exploitation artifacts tied to Win32k ConsoleControl offset confusion, such as unusual handle or object manipulation.
• Alert on known exploit tooling or payloads associated with CVE-2021-1732 appearing on endpoints.
• Correlate local privilege escalation events with subsequent defense evasion, persistence, or ransomware precursor activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.