CVE-2021-40450: Microsoft Win32k Elevation of Privilege Vulnerability

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited in the wild per CISA KEV and allows full privilege escalation, though it requires local access and has a moderate EPSS score.

What it is

CVE-2021-40450 is a Win32k elevation of privilege flaw in Microsoft Windows. A local attacker with low privileges can exploit it to gain higher privileges on the affected system. It is listed in CISA's Known Exploited Vulnerabilities catalog, so it has been exploited in the wild.

Impact

An attacker who successfully exploits this flaw gains elevated privileges on the host, potentially up to SYSTEM level. This allows full control of the affected machine and can serve as a stepping stone in a broader intrusion.

Attack surface

The vulnerability is local, requiring the attacker to already have code execution or an interactive session on the target with low privileges. No user interaction is needed beyond that local access, and no network vector is described.

Exploitation

CISA added this CVE to the KEV catalog on 2022-04-25, confirming exploitation in the wild. EPSS gives a 30-day probability of 0.02076 (80.5th percentile), indicating moderate likelihood of exploitation activity.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for all affected Windows versions.
• Restrict local interactive logon and limit low-privileged accounts that can run code on sensitive hosts.
• Enable exploit protection features such as ASLR and DEP, and keep Windows fully patched.
• Monitor for and remove unnecessary local user accounts and unapproved software that could provide an initial foothold.

Detection

• Monitor for unexpected privilege escalation events, such as processes gaining SYSTEM or high-integrity tokens without a legitimate parent.
• Audit Windows security logs for suspicious token manipulation or new service creation by low-privileged users.
• Track endpoint telemetry for known Win32k exploitation patterns and unusual driver or kernel activity.
• Correlate local logon events with subsequent high-privilege process creation to spot post-exploitation behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.