CVE-2021-31979: Windows Kernel memory buffer overflow elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is confirmed exploited in the wild per CISA KEV and gives full kernel-level control, though it requires an existing local foothold rather than remote access.

What it is

CVE-2021-31979 is a memory buffer overflow (CWE-119) in the Windows kernel that allows a local user to elevate privileges. It affects a broad set of Windows client and server releases, and Microsoft issued patches in July 2021. Because the kernel is the target, successful exploitation yields high-integrity control of the host.

Impact

An attacker who already has a foothold on the machine gains full control of the operating system at kernel level, enabling credential theft, disabling of security controls and further lateral movement. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reached locally (AV:L) with low attack complexity and low privileges required (PR:L), and no user interaction (UI:N). An attacker must already be able to run code on the target system; it is not remotely reachable on its own.

Exploitation

CVE-2021-31979 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming exploitation in the wild. EPSS gives a 30-day probability of 0.0454 (91st percentile), and CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft July 2021 security updates for all affected Windows client and server versions listed in the advisory.
• Prioritize patching of internet-facing and multi-user systems, and any host where untrusted code can execute.
• Enforce least privilege so that standard users cannot run arbitrary code locally, reducing the precondition for exploitation.
• Monitor for and remove unpatched or end-of-life builds (for example Windows 7 and Server 2008) that cannot receive current fixes.

Detection

• Alert on unexpected processes gaining SYSTEM or kernel-level privileges, especially from user-writable directories.
• Monitor for known local privilege escalation exploit tooling and suspicious driver or kernel object loading.
• Correlate post-exploitation behavior such as credential dumping, security service tampering or new admin account creation on patched and unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.