CVE-2021-31956: Windows NTFS integer underflow privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a locally exploitable privilege escalation with confirmed KEV exploitation and high EPSS, but it requires an existing low-privileged foothold rather than being remotely reachable.

What it is

CVE-2021-31956 is an elevation of privilege flaw in the Windows NTFS file system driver, rooted in an integer underflow (CWE-191). A local attacker who can run code on a vulnerable host can exploit it to gain higher privileges, which matters because it lets a low-privileged foothold become full system control.

Impact

An attacker gains elevated privileges on the affected Windows host, up to SYSTEM-level access, enabling further compromise of the machine and its data.

Attack surface

The vulnerability is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N), so it is reached by running crafted operations against NTFS from an already-established low-privileged session on the host.

Exploitation

It is listed in CISA KEV with a 2021-11-03 addition and a 2021-11-17 remediation due date, and EPSS shows a 30-day probability of 0.22273 (97.6th percentile), indicating observed exploitation activity. No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update for CVE-2021-31956 on all affected Windows versions listed in the advisory.
• Prioritize patching internet-facing and multi-user systems where a low-privileged local foothold is plausible.
• Restrict local logon and code execution rights to reduce the pool of accounts that can trigger the flaw.
• Monitor for and remove unpatched legacy systems (for example Windows 7, 8.1, Server 2008/2012) that cannot receive current fixes.

Detection

• Monitor for unexpected privilege escalation to SYSTEM or high-integrity processes originating from low-privileged user sessions.
• Watch for suspicious NTFS-related file operations or driver activity correlated with new local admin or SYSTEM process creation.
• Alert on exploitation indicators around NTFS parsing on hosts that have not applied the June 2021 or later cumulative updates.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.