CVE-2021-33742
Published: 08 June 2021
Summary
CVE-2021-33742 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-7 (Least Functionality).
Deeper analysis
The vulnerability CVE-2021-33742 is a remote code execution flaw in the Windows MSHTML Platform, assigned CWE-787 for out-of-bounds write and carrying a CVSS 3.1 score of 7.5. It affects the MSHTML rendering engine component used by multiple Windows applications.
An unauthenticated attacker can exploit the issue over the network with high attack complexity and required user interaction, resulting in full compromise of confidentiality, integrity, and availability on the target system under an unchanged scope.
Microsoft security guidance published at portal.msrc.microsoft.com details available patches and mitigations, while the vulnerability appears in the CISA Known Exploited Vulnerabilities catalog, confirming observed real-world exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-20419
Vulnerability details
Windows MSHTML Platform Remote Code Execution Vulnerability
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of Microsoft patches that remediate the out-of-bounds write in MSHTML.
Deploys malicious-code detection mechanisms that can block or alert on exploit payloads targeting the MSHTML RCE.
Enforces least functionality by disabling or restricting MSHTML-dependent features and components that are not required.