What is CVE-2021-34489?

CVE-2021-34489 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. DirectWrite Remote Code Execution Vulnerability

Which CVE IDs does CVE-2021-34489 cover?

CVE-2021-34489 covers the following CVE IDs: CVE-2021-34489. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2021-34489?

CVE-2021-34489 has a CVSS v3 base score of 7.8, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2021-34489?

CVE-2021-34489 affects 18 products, including: Windows 10 Version 1809 for 32-bit Systems; Windows 10 Version 1809 for ARM64-based Systems; Windows 10 Version 1809 for x64-based Systems; Windows 10 Version 1909 for 32-bit Systems; Windows 10 Version 1909 for ARM64-based Systems; and others — see the full list on the advisory page.

CVE-2021-34489HighCVSS 7.8

DirectWrite Remote Code Execution Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

July 13, 2021

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2021-34489 →

📋 Description

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires that a user open a specially crafted file. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.

🎯 Affected products18

Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server, version 2004 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)

✅ Remediation

KB5004244 (Security Update) — fixed build 10.0.17763.2061 KB5004245 (Security Update) — fixed build 10.0.18363.1679 KB5004237 (Security Update) — fixed build 10.0.19043.1110 KB5004237 (Security Update) — fixed build 10.0.19041.1110 KB5004237 (Security Update) — fixed build 10.0.19042.1110

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products18

✅ Remediation

🔗 References (7)