CVE-2021-33742: Windows MSHTML Platform out-of-bounds write enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is confirmed exploited in the wild and listed in CISA KEV with a very high EPSS score, but exploitation requires user interaction and is rated high complexity, so it is high rather than critical.

What it is

CVE-2021-33742 is an out-of-bounds write (CWE-787) in the Windows MSHTML Platform that leads to remote code execution. It affects a broad set of Windows client and server releases, and Microsoft has published a patch. Because MSHTML is the legacy rendering engine still reachable through many Windows components, the flaw matters to any organization that has not applied the June 2021 updates.

Impact

A successful attacker can execute arbitrary code in the context of the affected process, which on a user's system typically means the user's privileges. That can lead to full compromise of the host, data theft, or use as a foothold for lateral movement.

Attack surface

The CVSS vector is network-reachable (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R) and the attack is rated high complexity (AC:H). In practice this means a victim must be lured into opening or rendering attacker-controlled content through an MSHTML-based path.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, and EPSS gives a 30-day probability of about 0.59 (99th percentile). The record does not document ransomware use.

What to do

• Apply the Microsoft security update for CVE-2021-33742 on all affected Windows client and server versions; this is the primary fix.
• Prioritize internet-facing and user-workstation systems, and verify patch status against the CISA KEV due date of 2021-11-17.
• Reduce exposure of legacy MSHTML rendering paths where business needs allow, and restrict untrusted web content.
• Enforce email and web filtering to block known malicious documents and links, and keep endpoint protection signatures current.

Detection

• Hunt for processes such as Internet Explorer, mshta.exe, or other MSHTML-hosting processes spawning unexpected child processes like cmd.exe, powershell.exe, or script interpreters.
• Monitor for Office or browser applications writing executables or scripts to user-writable directories shortly after opening a document or URL.
• Review proxy and DNS logs for connections to newly registered or low-reputation domains that coincide with document or web content delivery.
• Alert on crashes or abnormal terminations in MSHTML-related processes, which can accompany out-of-bounds write exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.