CVE-2021-31201

Deeper analysis

Microsoft Enhanced Cryptographic Provider contains an elevation of privilege vulnerability tracked as CVE-2021-31201. The flaw affects the cryptographic provider component in Microsoft Windows environments and carries a CVSS 3.1 score of 5.2 with a vector indicating local attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and limited impacts to confidentiality and integrity.

A local attacker with low privileges can exploit the issue to obtain elevated rights on the affected system, resulting in partial disclosure or modification of information outside the original security scope. The vulnerability requires no user interaction and can be triggered through standard local access.

Microsoft has published guidance for the issue in its security advisory, and the vulnerability appears in the CISA catalog of known exploited vulnerabilities, confirming observed in-the-wild exploitation.