CVE-2021-36948

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is an elevation of privilege flaw in the Windows Update Medic Service, assigned CVE-2021-36948 with a CVSS 3.1 base score of 7.8. It affects the Windows Update Medic Service component on supported Windows systems and allows an attacker to gain elevated privileges on the host.

An attacker with local access and low privileges can exploit the issue without user interaction. Successful exploitation grants the ability to read, modify, or delete data with high impact across confidentiality, integrity, and availability, effectively allowing full control over the affected system.

Microsoft has published an advisory detailing the vulnerability and available updates. The flaw is listed in CISA's catalog of known exploited vulnerabilities, indicating confirmed real-world exploitation.