CVE-2021-31955: Windows Kernel information disclosure flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and a very high EPSS score, though it requires local low-privileged access and only discloses information.

What it is

CVE-2021-31955 is an information disclosure vulnerability in the Windows kernel affecting multiple Windows 10 and Windows Server builds. The record gives no root-cause detail beyond a CWE-497 mapping, so the exact leaked data and mechanism are not specified. It matters because kernel memory disclosure can expose sensitive data and is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker who can run code locally gains read access to kernel information, with high confidentiality impact but no integrity or availability impact. The leaked data could aid further attacks or expose sensitive in-memory content.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the flaw is reached by running code on the target host rather than over the network. No authentication beyond local low-privileged execution is needed.

Exploitation

CVE-2021-31955 is listed in CISA KEV with a 2021-11-17 remediation due date, indicating exploitation in the wild; EPSS is 0.81107 (99.6th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2021-31955 on all affected Windows 10 and Windows Server builds.
• Prioritize patching internet-facing and high-value hosts, and track remediation against the CISA KEV due date.
• Restrict local interactive and code-execution privileges to reduce the low-privileged local access the flaw requires.
• Monitor for and investigate suspicious local processes or drivers that could be used to read kernel memory.

Detection

• Hunt for unexpected local processes or drivers attempting to access kernel memory or system information.
• Correlate endpoint telemetry for post-exploitation activity on unpatched Windows 10 and Windows Server hosts.
• Track patch compliance for the affected Windows builds and alert on hosts still missing the MSRC update.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.