CVE-2021-41379

Think of Windows Installer as a helper that installs software with the power it needs to make changes. This bug is like a shortcut a low-privileged person could use locally to trick the installer into doing tasks with higher privileges. That can help attackers fully compromise a computer and then deploy ransomware or steal data.

This matters if you run the affected Microsoft Windows products (Windows 10/11, Windows 7/8.1/RT 8.1, and common Windows Server versions). Because it requires low-privileged local access, it’s most relevant to workplaces where untrusted users can log on to machines or where an attacker has already gained a foothold.
It’s a real risk when an attacker can reach the machine as a local (low-privilege) user; the threat is confirmed in ransomware activity listed by CISA.

This is RED because it’s confirmed in CISA’s Known Exploited Vulnerabilities list and has been used in ransomware campaigns. Attackers actively look for ways to escalate from limited access to full control, and this Windows Installer weakness is one of those paths.

1. Identify affected OS and current build

   • For each machine in scope, record: Windows product (e.g., Windows 10 vs Windows Server 2016), edition, and the current OS build (the “Version”/build number shown in Windows settings or via system information).

2. Determine whether you are already fixed

   • Compare your OS build to Microsoft’s fixed versions for this CVE:
     • Windows 10: fixed in 10.0.10240.19119; 10.0.14393.4770; 10.0.17763.2300; 10.0.18363.1916; 10.0.19041.1348; 10.0.19042.1348; 10.0.19043.1348
     • Windows 11: fixed in 10.0.22000.318
     • Windows Server: fixed in 10.0.19041.1348
     • Windows Server 2016: fixed in 10.0.14393.4770
     • Windows Server 2019: fixed in 10.0.17763.2300

3. Upgrade/patch to the fixed build

   • Use Microsoft’s update guidance for CVE-2021-41379 and apply the corresponding Windows security updates for each branch.
   • Validate after patching by re-checking the OS build number and confirming it is at or above the fixed version for that branch.

4. If patching is delayed (temporary risk reduction)

   • Reduce the likelihood of local low-privileged access: limit who can log onto workstations/servers, remove unnecessary accounts, and follow least-privilege for users.
   • Monitor for signs of local account compromise (suspicious logons, unusual process starts, or unexpected installer activity), then complete patching as soon as operationally feasible.

5. What to monitor

   • After updates, continue to review endpoint security alerts for privilege escalation behavior and ransomware indicators, especially on machines that had any unusual access patterns prior to patching.

Note: CISA KEV required action by 2022-03-17, and this issue is already confirmed exploited in the wild via KEV.

Severity/impact: Privilege Escalation (local attacker becomes elevated), leading to potential full system compromise.

Mechanism: The weakness is in Windows Installer’s handling of symbolic links. A local attacker with low privileges can exploit this behavior to run code with elevated rights; no user interaction is required.

Attack prerequisites: Low-privilege local access is required; exposure in the default configuration is not confirmed in the provided findings.

Exploitation status: This CVE is listed in CISA KEV (added 2022-03-03) and has been used in ransomware campaigns, so treat as actively exploited.

Patch: Microsoft provides fixed builds per Windows branch (notably multiple Windows 10 build thresholds and specific fixed builds for Windows 11 and Windows Server branches) in the linked Microsoft update guidance.

KEV meaning here: KEV indicates the vulnerability is known to be exploited in real-world attacks; it overrides purely predictive likelihood metrics for prioritization.

Exploit availability: No public exploit code was found in the provided findings, but that does not reduce risk given KEV confirmation.