Desktop Window Manager vulnerability

Window Manager vulnerability

Description:
CVE-2021-28310 is an out-of-bounds (OOB) write vulnerability in dwmcore.dll, which is part of Desktop Window Manager (dwm.exe). Due to the lack of bounds checking, attackers are able to create a situation that allows them to write controlled data at a controlled offset using DirectComposition API.

Impact:
It is an escalation of privilege (EoP) exploit that is likely used together with other browser exploits to escape sandboxes or get system privileges for further access.

System Affected:
Detail list is given reference URL:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-28310

Mitigation:
Updates are available. Please see the references or vendor advisory for more information.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-28310

Reference URL’s:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-28310
https://securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898/
https://www.kaspersky.com/blog/cve-2021-28310/39352/
https://nvd.nist.gov/vuln/detail/CVE-2021-28310