Use-after-free in Microsoft Windows and Windows Server - CVE-2021-31166
Published: May 11, 2021 / Updated: October 25, 2024
Vulnerability identifier: #VU53113
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-31166
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in HTTP Protocol Stack. A remote attacker can send a specially crafted HTTP request to the affected system and execute arbitrary code.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2021-31166
Install updates from vendor's website.
Links to Public Exploits and PoC-codes
- Exploit #10647 - Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution (October 25, 2024)
- Exploit #10514 - CVE-2021-31166 (Windows HTTP协议栈远程代码执行漏洞 CVE-2021-31166) (September 20, 2024)
- Exploit #8626 - Home-Demolisher (PoC for CVE-2021-31166 and CVE-2022-21907) (November 22, 2022)
- Exploit #7787 - Windows IIS HTTP Protocol Stack DOS (May 12, 2022)
- Exploit #7429 - CVE-2021-31166 (CVE-2021-31166: exploitation with Powershell, Python, Ruby, NMAP and Metasploit.) (March 7, 2022)
- Exploit #6941 - CVE-2021-31166 (PoC for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. Although it was defined as remote command execution, it can only cause the system to crash.) (October 26, 2021)
- Exploit #6795 - CVE-2021-31166 (Windows HTTP协议栈远程代码执行漏洞 CVE-2021-31166) (September 27, 2021)
- Exploit #6508 - CVE-2021-31166-Exploit (Exploit for MS Http Protocol Stack RCE vulnerability (CVE-2021-31166)) (July 4, 2021)
- Exploit #5462 - WIn-CVE-2021-31166 () (May 24, 2021)
- Exploit #5451 - CVE-2021-31166 (simple bash script for exploit CVE-2021-31166) (May 20, 2021)
- Exploit #5415 - CVE-2021-31166 (Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.) (May 17, 2021)
- Exploit #5414 - CVE-2021-31166 (PoC for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. Although it was defined as remote command execution, it can only cause the system to crash.) (May 17, 2021)