Actively exploited in the wild
Microsoft Windows Scripting Engine Memory Corruption Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-34448
MediumCVSS 6.8KEVExploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Memory corruption vulnerability in the scripting engine. It could allow remote code execution in the context of the logged-in user.
Risk Assessment
An attacker could exploit this vulnerability to take control of the victim's system if they visit a malicious website or open a specially crafted file.
Recommendation
Install the latest security updates from the software vendor.
Other vulnerabilities in Scripting Engine
See all- CVE-2024-38178HighActively exploited
A vulnerability in the Scripting Engine involves memory corruption. The NVD description does not provide technical details or attack vectors.
- CVE-2021-34480Medium
A memory corruption vulnerability in the Scripting Engine in Microsoft systems. Technical details are not available in the description.
Original NVD description (English source)
Scripting Engine Memory Corruption Vulnerability
Vulnerability data from NVD (NIST) · CISA KEV · EPSS