CVE-2021-1732: Windows Win32k Privilege Escalation Flaw

CVE-2021-1732 Overview

CVE-2021-1732 is an elevation of privilege vulnerability in the Windows Win32k kernel-mode driver. The flaw allows a local, authenticated attacker to escalate from a low-integrity user context to SYSTEM by triggering an out-of-bounds write [CWE-787] in win32kfull.sys. Microsoft Windows 10 and Windows Server releases from 1803 through 20H2 are affected. CISA added the issue to its Known Exploited Vulnerabilities catalog after threat actors weaponized it in targeted attacks. Public proof-of-concept code is available through Packet Storm, lowering the barrier for commodity malware to integrate the technique.

Critical Impact

Successful exploitation grants SYSTEM-level privileges, enabling full control of the affected Windows host, credential theft, and persistence.

Affected Products

• Microsoft Windows 10 versions 1803, 1809, 1909, 2004, and 20H2
• Microsoft Windows Server versions 1909, 2004, and 20H2
• Microsoft Windows Server 2019

Discovery Timeline

• 2021-02-25 - CVE-2021-1732 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2021-1732

Vulnerability Analysis

The vulnerability resides in the Win32k subsystem, specifically in the user-mode callback path that handles window creation. When NtUserCreateWindowEx invokes the user-mode callback xxxClientAllocWindowClassExtraBytes, a malicious application can hook the callback and modify the window object before the kernel resumes execution. The kernel then misinterprets a flag indicating whether the extra class memory is stored inline or as a kernel pointer. This offset confusion leads to an out-of-bounds write to an attacker-controlled address.

Root Cause

The root cause is a state desynchronization between user mode and kernel mode during a window object initialization callback. The tagWND structure contains a flag that determines how cbwndExtra data is referenced. By altering this flag during the callback, an attacker forces the kernel to treat a user-mode offset as a kernel-mode pointer, producing an arbitrary write primitive classified as CWE-787.

Attack Vector

Exploitation requires local code execution with standard user privileges. No user interaction is needed. The attacker invokes CreateWindowEx with a crafted class structure, intercepts the kernel callback, and converts the resulting arbitrary write into a token replacement primitive. The final stage swaps the process token with that of a SYSTEM process such as services.exe, granting full kernel-equivalent privileges.

Verified proof-of-concept exploits are documented in the Packet Storm Offset Confusion Exploit and the Packet Storm Privilege Escalation Exploit advisories.

Detection Methods for CVE-2021-1732

Indicators of Compromise

• Unexpected child processes spawned by low-privilege user processes running as NT AUTHORITY\SYSTEM.
• Process token replacement events where a non-elevated process suddenly inherits a SYSTEM token without using documented elevation APIs.
• Crash dumps referencing win32kfull!xxxClientAllocWindowClassExtraBytes or access violations in NtUserConsoleControl.
• Loading of unsigned or atypical DLLs into processes that subsequently call CreateWindowEx with unusual class extra byte counts.

Detection Strategies

• Monitor for token impersonation anomalies where a user-context process gains SYSTEM privileges without a corresponding service or UAC event.
• Hunt for kernel pool corruption indicators using Event Tracing for Windows (ETW) Microsoft-Windows-Kernel-Memory providers.
• Correlate Windows Error Reporting bugchecks in win32kfull.sys with process execution telemetry from the same user session.

Monitoring Recommendations

• Enable kernel-mode auditing and forward Sysmon Event ID 1 and Event ID 10 logs to a central SIEM for token-access analysis.
• Track abnormal calls to NtUserConsoleControl and NtUserCreateWindowEx paired with user-mode callbacks from non-graphical applications.
• Alert on EPSS-driven exploit probability spikes for this CVE, which exceeds 88% according to current data.

How to Mitigate CVE-2021-1732

Immediate Actions Required

• Apply the February 2021 Patch Tuesday updates from Microsoft to all affected Windows 10 and Windows Server builds.
• Inventory endpoints running Windows 10 1803 through 20H2 and Server 2019 / 1909 / 2004 / 20H2 to confirm patch coverage.
• Revoke local administrator rights for standard users to reduce the post-exploitation impact of a successful escalation.
• Treat any unpatched system as compromised if SYSTEM-level activity from user processes is observed.

Patch Information

Microsoft released fixes through the Microsoft Security Advisory CVE-2021-1732. The patch corrects the validation logic inside xxxClientAllocWindowClassExtraBytes so the kernel no longer trusts the user-mode flag describing how class extra bytes are referenced. CISA mandates remediation for federal agencies per the CISA Known Exploited Vulnerability listing.

Workarounds

• No vendor-supplied workaround exists. Patching is the only supported remediation.
• Apply application allowlisting to block execution of untrusted binaries that could deliver the exploit.
• Restrict interactive logon on servers to limit local attack surface where the vulnerability is exploitable.

# Verify patch level on Windows hosts (PowerShell)
Get-HotFix | Where-Object { $_.HotFixID -in @('KB4601319','KB4601345','KB4601348','KB4601349','KB4601354') }

# Identify affected Windows builds across an environment
Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber