Main Vulnerability Database Vulnerabilities #VU50138

NULL pointer dereference in Microsoft Windows and Windows Server - #VU50138

Published: January 29, 2021

Vulnerability identifier: #VU50138

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a NULL pointer dereference error within the win32kfull.sys driver.. A local user can run a specially crafted program on the system, trigger a NULL pointer dereference error and execute arbitrary code with SYSTEM privileges.

Affected software

Microsoft Windows
Windows Server

Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External References

https://www.zerodayinitiative.com/advisories/ZDI-21-090/

Related Security Bulletins