CVE-2021-41330 is a remote code execution vulnerability in Microsoft Windows Media Foundation, affecting Windows 10, Windows Server 2016, and Windows Server 2019. With a CVSS score of 7.8 (High), it allows an unauthenticated attacker to achieve high impact on confidentiality, integrity, and availability, requiring user interaction but with low attack complexity. While not actively exploited in the wild and lacking public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion and media coverage, indicating awareness despite its inactive status on the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20h2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:* | ||
21h1CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:* | ||
1809CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* | ||
1909CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* | ||
2004CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.