CVE-2021-38112 describes a remote code execution vulnerability in Amazon AWS WorkSpaces client versions 3.0.10 through 3.1.8 on Windows. This flaw stems from argument injection within the workspaces:// URI handler, specifically leveraging the Chromium Embedded Framework (CEF) --gpu-launcher argument. The vulnerability carries a CVSS score of 8.8 (High), indicating a critical risk. It can be exploited remotely with low attack complexity, requiring user interaction, and could lead to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation (KEV list), public exploit code (Metasploit, Nuclei, ExploitDB) is not available. However, the vulnerability has garnered some community discussion and media coverage, suggesting awareness within the security community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0.10, < 3.1.9CPE matchmatch criteria | cpe:2.3:a:amazon:aws_workspaces:*:*:*:*:*:windows:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.