CVE-2021-28310: Microsoft Windows Win32k out-of-bounds write privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a kernel elevation flaw with confirmed in-the-wild exploitation per CISA KEV, though it requires local access and a low-privileged foothold.

What it is

CVE-2021-28310 is an out-of-bounds write (CWE-787) in the Windows Win32k component that allows a local user to elevate privileges. It affects multiple Windows 10 and Windows Server builds, and Microsoft released a patch in April 2021. Because it is a kernel-level elevation flaw that has been exploited in the wild, it is a priority for endpoint patching.

Impact

A local attacker who can run code on a vulnerable host can exploit the out-of-bounds write to gain SYSTEM-level privileges. That access can then be used to disable defenses, persist, or move laterally.

Attack surface

The flaw is reached locally through the Win32k subsystem, requiring the attacker to already have a low-privileged account or code execution on the target. No user interaction is needed, and the CVSS vector confirms local access with low privileges.

Exploitation

CVE-2021-28310 is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation, and its EPSS 30-day probability is about 8.3 percent (94.6th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the Microsoft security update for CVE-2021-28310 to all affected Windows 10 and Windows Server builds.
• Prioritize patching internet-facing and high-value endpoints, then work through remaining systems per the CISA KEV remediation timeline.
• Restrict local logon and code execution rights so untrusted users cannot run code on sensitive hosts.
• Monitor for and block known exploitation tooling and suspicious local privilege-escalation behavior on unpatched systems.

Detection

• Alert on unexpected processes gaining SYSTEM or high-integrity tokens shortly after a low-privileged process starts.
• Monitor for known Win32k exploitation artifacts and suspicious child processes spawned from user-writable directories.
• Track unpatched Windows 10 and Windows Server hosts against the affected build list and flag them for remediation.
• Correlate local privilege-escalation alerts with subsequent credential access or defense-evasion activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.