CVSS 7.8 HIGH Bulletin: Microsoft MSRC CVE-2021-33771 Published: 2021-07-13

CVE-2021-33771: Microsoft Windows GDI Privilege Escalation Kernel Zero-Day (Candiru / DevilsTongue)

Technical intelligence and weaponization dossier for CVE-2021-33771. Documented exploitation across 1 active malware families totaling 45 analyzed telemetry samples.

Attributed Families

Sample Volume

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2021-33771
Common Name / Bulletin	Microsoft Windows GDI Privilege Escalation Kernel Zero-Day (Candiru / DevilsTongue) (`Microsoft MSRC CVE-2021-33771`)
CWE Classification	`CWE-119: Memory Corruption in win32kfull.sys`
Affected Software & Versions	Microsoft Windows 10, Windows Server 2019/2022
Technical Root Cause	Kernel memory corruption in win32kfull.sys allowing an authenticated local attacker with low integrity to bypass kernel memory protection structures and execute arbitrary code in kernel mode (ring-0).
Associated ATT&CK Techniques	`T1068` — Associated ATT&CK Technique `T1055` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2021-33771

Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

1 families

Malware Family	Category	Catalog Samples	Operational Profile
candiru	Spyware	`45`	Candiru (operating under corporate entities Saito Tech Ltd, Taveta Ltd, and Grindavik Solutions) is an Israeli commercial cyber-surveillance contractor speciali...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2021-33771 in enterprise intrusions and campaign toolkits:

Candiru — Attributed Threat Group / Campaign Operator
Saito Tech Ltd — Attributed Threat Group / Campaign Operator
Taveta — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2021-33771 in enterprise networks:

EDR telemetry: Non-standard kernel GDI handle allocations and unbacked ring-0 thread executions associated with browser sandboxes.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Apply Microsoft July 2021 Patch Tuesday security updates; enable Exploit Guard and Attack Surface Reduction rules.

For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →

← Return to Vulnerability Matrix Directory (All 63 CVEs)