Technical intelligence and weaponization dossier for CVE-2021-31979. Documented exploitation across 1 active malware families totaling 45 analyzed telemetry samples.
| Vulnerability ID | CVE-2021-31979 |
|---|---|
| Common Name / Bulletin | Microsoft Windows Kernel Graphics / GDI Elevation of Privilege Zero-Day (Candiru / DevilsTongue) (Microsoft MSRC CVE-2021-31979) |
| CWE Classification | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
| Affected Software & Versions | Microsoft Windows 10, Windows Server 2016/2019 |
| Technical Root Cause | Out-of-bounds memory read/write vulnerability in the Windows Graphics Device Interface (GDI) kernel driver (win32k.sys). Weaponized in the wild by Candiru alongside CVE-2021-33771 to escape browser sandboxes and escalate privileges to NT AUTHORITY\SYSTEM. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
Threat intelligence confirms the following adversaries weaponize CVE-2021-31979 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2021-31979 in enterprise networks:
EventID 4688: Process creation showing abnormal win32k.sys graphics driver allocations and unexpected SYSTEM token assignment to low-integrity browser renderers.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →