{"uuid": "7058b123-6024-497e-bace-c9140d91daf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1732", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2022_21882_win32k.rb", "content": "{\"actions\": [], \"aliases\": [\"exploit/windows/local/cve_2021_1732_win32k\"], \"arch\": \"x64\", \"author\": [\"BITTER APT\", \"JinQuan\", \"MaDongZe\", \"TuXiaoYi\", \"LiHao\", \"L4ys\", \"KaLendsi\", \"Spencer McIntyre\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of\\n            NT AUTHORITY\\\\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being\\n            treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to\\n            achieve an out of bounds write operation, eventually leading to privilege escalation.\\n\\n            This flaw was originally identified as CVE-2021-1732 and was patched by Microsoft on February 9th, 2021.\\n            In early 2022, a technique to bypass the patch was identified and assigned CVE-2022-21882. The root cause is\\n            is the same for both vulnerabilities. This exploit combines the patch bypass with the original exploit to\\n            function on a wider range of Windows 10 targets.\", \"disclosure_date\": \"2021-02-09\", \"fullname\": \"exploit/windows/local/cve_2022_21882_win32k\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:46 +0000\", \"name\": \"Win32k ConsoleControl Offset Confusion\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/exploits/windows/local/cve_2022_21882_win32k.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"windows/local/cve_2022_21882_win32k\", \"references\": [\"CVE-2021-1732\", \"URL-https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/\", \"URL-https://github.com/KaLendsi/CVE-2021-1732-Exploit\", \"URL-https://attackerkb.com/assessments/1a332300-7ded-419b-b717-9bf03ca2a14e\", \"URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732\", \"URL-https://www.fuzzysecurity.com/tutorials/expDev/22.html\", \"URL-https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/index.htm\", \"URL-https://byteraptors.github.io/windows/exploitation/2020/06/03/exploitingcve2019-1458.html\", \"URL-https://www.trendmicro.com/en_us/research/16/l/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild.html\", \"CVE-2022-21882\", \"URL-https://github.com/L4ys/CVE-2022-21882\", \"URL-https://github.com/KaLendsi/CVE-2022-21882\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Windows 10 v1803-21H2 x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:08.588667Z"}