CVE-2021-34448: Microsoft Windows Scripting Engine out-of-bounds write memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA's KEV catalog with confirmed in-the-wild exploitation and a high EPSS percentile, though the CVSS base score is medium and exploitation requires user interaction and high complexity.

What it is

CVE-2021-34448 is an out-of-bounds write (CWE-787) in the Microsoft Windows Scripting Engine that corrupts memory and can lead to code execution. It affects a broad set of Windows client and server releases, and Microsoft has issued patches. Because the scripting engine is widely present and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog, it warrants prompt remediation.

Impact

An attacker who successfully triggers the flaw can corrupt memory and potentially execute code in the context of the affected process or user. The CVSS vector shows high confidentiality and integrity impact with no availability impact.

Attack surface

The vulnerability is network-reachable (AV:N) but requires user interaction (UI:R) and has high attack complexity (AC:H), with no privileges required (PR:N). In practice this means a victim must be induced to open or render attacker-controlled content that exercises the scripting engine.

Exploitation

CVE-2021-34448 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild. EPSS gives a 30-day probability of 0.40062 (98.6th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft security updates referenced in the MSRC advisory for all affected Windows versions.
• Prioritize patching internet-facing and user-workstation systems, then servers, per CISA KEV due date.
• Reduce exposure by restricting execution of untrusted script content and blocking untrusted sources where feasible.
• Keep endpoint protection and browser/email filtering current to catch delivery of malicious script content.

Detection

• Monitor for crashes or abnormal behavior in Windows scripting engine processes (for example, wscript.exe, cscript.exe, or browser script hosts).
• Hunt for processes spawning from script hosts or browsers that then execute unusual child processes or write to unexpected locations.
• Review endpoint telemetry for exploitation indicators around the time users open documents, web pages, or other script-bearing content.
• Track patch compliance for the affected Windows builds and flag unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.