CVE-2021-33739

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.066 · 94 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 2 exploits · PoC

Likely / severe?

6.55% (94th) EPSS

CVSS 4.6 · medium

Is it mine?

18 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2021-11-03remediate by 2021-11-17

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

Microsoft DWM Core Library Elevation of Privilege Vulnerability

cvss

Technical severity, 0–10. One row per scoring source.

8.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.6–8.4

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 6.4

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:P/E:Hsecondary · CVSS-BT (t0sche)

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.18.4highAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.4highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:Csecondary · ENISA EU

v3.18.4highCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 2.5 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-264US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (2)

Public proof-of-concept and weaponised exploit code.

freeide2017/CVE-2021-33739-POCfreeide2017/CVE-2021-33739-POCPoC · poc_in_github
giwon9977/CVE-2021-33739_PoC_AnalysisCVE-2021-33739 PoC AnalysisPoC · poc_in_github

affected products (18)

Products and version ranges known to be affected.

Microsoft Windows 10 Version 190910.0.0 → 10.0.18363.1621enisa_euvdEU
Microsoft Windows 10 Version 200410.0.0 → 10.0.19041.1052enisa_euvdEU
Microsoft Windows 10 Version 20H210.0.0 → 10.0.19042.1052enisa_euvdEU
Microsoft Windows 10 Version 21H110.0.0 → 10.0.19043.1052enisa_euvdEU
Microsoft Windows Server version 200410.0.0 → 10.0.19041.1052enisa_euvdEU
Microsoft Windows Server version 20H210.0.0 → 10.0.19042.1052enisa_euvdEU
Microsoft Corp Windows 10 1909all versionsfstec_bduRU
Microsoft Corp Windows 10 2004all versionsfstec_bduRU
Microsoft Corp Windows 10 20H2all versionsfstec_bduRU
Microsoft Corp Windows 10 21H1all versionsfstec_bduRU
Microsoft Corp Windows Server 2004 (Server Core Installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 20H2 (Server Core Installation)all versionsfstec_bduRU
microsoft windows 10 1909< 10.0.18363.1621nvdUScpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*
microsoft windows 10 2004< 10.0.19041.1052nvdUScpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*
microsoft windows 10 20h2< 10.0.19042.1052nvdUScpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*
microsoft windows 10 21h1< 10.0.19043.1052nvdUScpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*
microsoft windows server 2004< 10.0.19041.1052nvdUScpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*
microsoft windows server 20h2< 10.0.19042.1052nvdUScpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2021-06-08modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan