Skip to content
OpenAdvisories
High 1 exploited CVE MSRC-CVE-2021-40444 1 CVE

Microsoft MSHTML Remote Code Execution Vulnerability

Published Sep 7, 2021 · Updated Aug 16, 2022 · Revision 5

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Exploited according to Microsoft, publicly disclosed before the fix — Exploitation Detected. Customer action: Required.

Details

There are three updates listed in the Security Updates table for Windows 8.1, Windows Server 2012 R2, and Windows Server 2012. Which updates do I need to apply to my system to be protected from this vulnerability?
Customers running Windows 8.1, Windows Server 2012 R2, or Windows Server 2012 can apply either the Monthly Rollup or both the Security Only and the IE Cumulative updates.
The Monthly Rollup for Windows 7, Windows Server 2008 R2, and Windows Server 2008 includes the update for this vulnerability. Customers who apply the Monthly Rollup do not need to apply the IE Cumulative update., Customers who only apply Security Only updates need to also apply the IE Cumulative update to be protected from this vulnerability.

Security updates
10.0.17763.2183 — https://support.microsoft.com/help/5005568
10.0.18363.1801 — https://support.microsoft.com/help/5005566
10.0.19043.1237 — https://support.microsoft.com/help/5005565
10.0.20348.230 — https://support.microsoft.com/help/5005575
10.0.10240.19060 — https://support.microsoft.com/help/5005569
10.0.14393.4651 — https://support.microsoft.com/help/5005573
6.1.7601.25712 — https://support.microsoft.com/help/5005633
1.001 — https://support.microsoft.com/help/5005563
6.1.7601.26221 — https://support.microsoft.com/help/5019958
6.3.9600.20120 — https://support.microsoft.com/help/5005613
6.3.9600.20120 — https://support.microsoft.com/help/5005627
6.0.6003.21218 — https://support.microsoft.com/help/5005606
6.2.9200.23462 — https://support.microsoft.com/help/5005623

Vulnerabilities 1

Revision history

  1. #5

    Updated links to security updates. This is an informational change only.

  2. #4

    For all CVEs affecting Windows that were released on September 14, 2021: 1) In the Security Updates table, the Build Numbers for KB KB5005565 have been corrected for all affected editions of the following versions of Windows 10: Windows 10, version 2004, all editions; Windows Server, version 2004 (Server Core installation); Windows 10, version 20H2; Windows Server, version 20H2 (Server Core Installation); Windows 10, version 21H1. 2) For CVEs where Windows Server 2022 is affected the links have been updated to point to information related to [5005575](https://support.microsoft.com/en-us/help/5005575). Customers whose Windows devices are configured to receive automatic updates do not need to take any further action.

  3. #3

    CVE updated to announce that Microsoft is releasing security updates for all affected versions of Windows to address this vulnerability. These updates include Monthly Rollups, Security Only, and IE Cumulative updates. Please see the FAQ for information on which updates are applicable to your system. Other information has been updated as well, including the following: 1) Executive Summary has been updated 2) FAQs have been added.

  4. #2

    The information in the workaround section was updated. This an informational change only.

  5. #1

    Information published.

References