{"uuid": "0bc5d71f-99c8-4f54-bfaf-48c263fcbcd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40449", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2021_40449.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x64\", \"author\": [\"IronHusky\", \"Costin Raiu\", \"Boris Larin\", \"Red Raindrop Team of Qi'anxin Threat Intelligence Center\", \"KaLendsi\", \"ly4k\", \"Grant Willcox\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by\\n            an attacker to escalate privileges to those of `NT AUTHORITY\\\\SYSTEM`. The flaw exists due to the fact\\n            that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers\\n            can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object\\n            that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle\\n            with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the\\n            attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the\\n            kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\\\SYSTEM.\\n\\n            This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions\\n            of Windows 10 will likely also work.\", \"disclosure_date\": \"2021-10-12\", \"fullname\": \"exploit/windows/local/cve_2021_40449\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Win32k NtGdiResetDC Use After Free Local Privilege Elevation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/exploits/windows/local/cve_2021_40449.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 400, \"ref_name\": \"windows/local/cve_2021_40449\", \"references\": [\"CVE-2021-40449\", \"URL-https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/\", \"URL-https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ\", \"URL-https://github.com/KaLendsi/CVE-2021-40449-Exploit\", \"URL-https://github.com/ly4k/CallbackHell\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Windows 10 x64 RS1 (build 14393) and RS5 (build 17763)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:08.499883Z"}