Cyber Resilience

CVE-2021-34486

HighCISA KEVActive ExploitationEUVD Exploited

Published: 12 August 2021

Published
12 August 2021
Modified
30 October 2025
KEV Added
28 March 2022
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.3647 97.2th percentile
Risk Priority 57 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-34486 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).

Deeper analysis

Windows Event Tracing contains an elevation of privilege vulnerability tracked as CVE-2021-34486 and assigned CWE-416 for use-after-free. The flaw affects the Windows Event Tracing component and carries a CVSS 3.1 base score of 7.8 reflecting local attack vector, low complexity, low privileges required, and high impact on confidentiality, integrity, and availability.

A local attacker with low privileges can exploit the condition without user interaction to execute arbitrary code with elevated rights on the affected system. Successful exploitation grants the attacker full control over the compromised host.

Microsoft's security advisory and the CISA Known Exploited Vulnerabilities catalog both reference this issue, confirming that patches are available through standard Windows update channels and that the vulnerability has been observed in active exploitation.

EU & UK References

Vulnerability details

Windows Event Tracing Elevation of Privilege Vulnerability

CWE(s)
KEV Date Added
28 March 2022

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10 1809
≤ 10.0.17763.2114
microsoft
windows 10 1909
≤ 10.0.18363.1734
microsoft
windows 10 2004
≤ 10.0.19041.1165
microsoft
windows 10 20h2
≤ 10.0.19042.1165
microsoft
windows 10 21h1
≤ 10.0.19043.1165
microsoft
windows server 2004
≤ 10.0.19041.1165
microsoft
windows server 2019
≤ 10.0.17763.2114
microsoft
windows server 20h2
≤ 10.0.19042.1165

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely application of vendor patches that remediate the use-after-free flaw in Windows Event Tracing.

prevent

Enforces least-privilege restrictions that limit the initial low-privilege context an attacker must obtain before exploiting the EoP.

prevent

Implements memory-protection mechanisms that can block or complicate exploitation of the CWE-416 use-after-free condition.

References