CVE-2021-1732

HIGH KEV RANSOMWARE

Windows 10 1803-20H2 and Windows Server 1909-20H2 - Elevation of Privilege via Win32k ConsoleControl Offset Confusion

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-1732 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 17 public exploits from researchers including KaLendsi, Pai-Po, exploitblizzard, including a Metasploit module exploits/windows/local/cve_2022_21882_win32k.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k elevation of privilege vulnerability. The exploit leverages a race condition and memory corruption to escalate privileges by manipulating window class extra bytes and kernel callbacks.

Description

Windows Win32k Elevation of Privilege Vulnerability

Exploits (17)

nomisec WORKING POC 421 stars
by KaLendsi · local
https://github.com/KaLendsi/CVE-2021-1732-Exploit

This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k elevation of privilege vulnerability. The exploit leverages a race condition and memory corruption to escalate privileges by manipulating window class extra bytes and kernel callbacks.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows (Win32k component)
No auth needed
Prerequisites: Local access to a vulnerable Windows system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 66 stars
by Pai-Po · local
https://github.com/Pai-Po/CVE-2021-1732

This repository contains a functional exploit for CVE-2021-1732, a Windows local privilege escalation vulnerability. The code demonstrates a complex exploit chain involving window object manipulation, callback hooking, and token duplication to achieve SYSTEM privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Windows 10 (specific versions affected by CVE-2021-1732)
No auth needed
Prerequisites: Local access to a vulnerable Windows system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 31 stars
by exploitblizzard · local
https://github.com/exploitblizzard/Windows-Privilege-Escalation-CVE-2021-1732

This repository contains a functional exploit for CVE-2021-1732, a Windows privilege escalation vulnerability. The code demonstrates a local privilege escalation (LPE) by manipulating window objects and exploiting a use-after-free condition in the Windows kernel.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Windows 10 (versions 1809 and later)
Auth required
Prerequisites: Local access to a vulnerable Windows system · User-level privileges
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 15 stars
by fenalik · local
https://github.com/fenalik/CVE-2021-1732

This repository contains a functional exploit for CVE-2021-1732, a Windows kernel privilege escalation vulnerability. The exploit leverages a use-after-free in the win32k driver to achieve arbitrary kernel memory read/write and ultimately escalate privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Windows 10 1809 (17763)
No auth needed
Prerequisites: Windows 10 1809 (17763) system · Local access to the target machine
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 4 stars
by 4dp · local
https://github.com/4dp/CVE-2021-1732

This repository contains a functional exploit for CVE-2021-1732, a Windows local privilege escalation vulnerability. The exploit manipulates window class extra bytes and kernel callbacks to achieve arbitrary kernel memory read/write, targeting Windows 10 1809 (17763).

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Windows 10 1809 (17763)
No auth needed
Prerequisites: Local access to a vulnerable Windows 10 1809 system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by linuxdy · local
https://github.com/linuxdy/CVE-2021-1732_exp

This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k privilege escalation vulnerability. The exploit leverages a race condition in the Windows kernel to achieve local privilege escalation by manipulating window class extra bytes and kernel callbacks.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows (Win32k component)
Auth required
Prerequisites: Local access to a vulnerable Windows system · Ability to execute arbitrary code on the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by asepsaepdin · local
https://github.com/asepsaepdin/CVE-2021-1732

This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k Elevation of Privilege vulnerability. The code demonstrates a local privilege escalation (LPE) by manipulating window objects and leveraging a use-after-free condition to achieve SYSTEM privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows (Win32k.sys)
Auth required
Prerequisites: Local access to a vulnerable Windows system · Basic user privileges
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by BeneficialCode · poc
https://github.com/BeneficialCode/CVE-2021-1732

This repository contains a functional exploit for CVE-2021-1732, a Windows kernel vulnerability. The exploit leverages a use-after-free in win32k to achieve local privilege escalation (LPE) by manipulating kernel objects and callback functions.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Windows 10 (specific versions affected by CVE-2021-1732)
No auth needed
Prerequisites: Local access to the target system · Vulnerable Windows kernel version
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by oneoy · poc
https://github.com/oneoy/CVE-2021-1732-Exploit

This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k privilege escalation vulnerability. The exploit leverages a race condition in the Windows kernel to achieve local privilege escalation by manipulating window class extra bytes and hooking kernel callbacks.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Microsoft Windows (Win32k.sys)
Auth required
Prerequisites: Local access to a vulnerable Windows system · Ability to execute arbitrary code on the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by ExploitCN · poc
https://github.com/ExploitCN/CVE-2021-1732-EXP-

The repository contains only a minimal assembly snippet (INT3.asm) with an INT 3 instruction, which is insufficient to demonstrate exploitation of CVE-2021-1732. No functional exploit code or technical details are provided.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Windows (CVE-2021-1732 affects Windows 10 and Server)
No auth needed
Prerequisites: None specified
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by flyinbedxyz · poc
https://github.com/flyinbedxyz/CVE-2021-1732

This repository contains a functional exploit for CVE-2021-1732, a Windows local privilege escalation vulnerability. The exploit leverages a race condition in the win32k driver to achieve arbitrary kernel memory read/write, ultimately escalating privileges to SYSTEM.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Windows 10 1809 (17763)
Auth required
Prerequisites: Local access to a vulnerable Windows system · Ability to execute code on the target system
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC NORMAL
by BITTER APT, JinQuan, MaDongZe, TuXiaoYi, LiHao, L4ys, KaLendsi, Spencer McIntyre · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2022_21882_win32k.rb

This Metasploit module exploits a privilege escalation vulnerability in Windows 10 (CVE-2021-1732 and CVE-2022-21882) by manipulating the WndExtra field in win32k to achieve an out-of-bounds write, leading to SYSTEM privileges. It combines the original exploit with a patch bypass for broader compatibility.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Windows 10 (versions 1803-21H2), Windows 11 21H2, Server 2019, Server 2022
Auth required
Prerequisites: Local access to a vulnerable Windows system · Non-admin session
devstral-2 · analyzed Apr 24, 2026 Full analysis →
patchapalooza WORKING POC
by r1l4-i3pur1l4 · local
https://github.com/r1l4-i3pur1l4/CVE-2021-1732

This repository contains a functional exploit for CVE-2021-1732, a Win32k elevation of privilege vulnerability. The PoC leverages kernel callback table manipulation and window object manipulation to achieve privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Microsoft Windows (Win32k component)
Auth required
Prerequisites: Local access to a vulnerable Windows system · Ability to execute arbitrary code on the target system
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by zyjsuper · poc
https://gitee.com/zyjsuper/CVE-2021-1732-Exploit

This repository contains a functional exploit for CVE-2021-1732, a Windows local privilege escalation vulnerability. The code demonstrates a kernel callback table hooking technique to achieve arbitrary memory read/write and escalate privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Windows 10 1909 x64
No auth needed
Prerequisites: Windows 10 1909 x64 system
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WRITEUP
by Ascotbe · local
https://github.com/Ascotbe/Kernelhub

This repository is a documentation hub for Windows kernel exploits, including CVE-2021-1732, with structured README files and automated documentation generation. It does not contain functional exploit code but provides detailed technical references and categorization of vulnerabilities.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Windows Kernel
No auth needed
Prerequisites: access to documentation · understanding of kernel exploits
devstral-2 · analyzed Feb 23, 2026 Full analysis →

Scores

CVSS v3 7.8
EPSS 0.8832
EPSS Percentile 99.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2020-12-10
InTheWild.io 2020-12-10
ENISA EUVD EUVD-2021-7196
Ransomware Use Confirmed
CWE
CWE-787
Status published
Products (9)
microsoft/windows_10_1803
microsoft/windows_10_1809
microsoft/windows_10_1909
microsoft/windows_10_2004
microsoft/windows_10_20h2
microsoft/windows_server_1909
microsoft/windows_server_2004
microsoft/windows_server_2019
microsoft/windows_server_20h2
Published Feb 25, 2021
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026