Back to CVE Browser

CVE-2021-31166

Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score91.3050%

EPSS Percentile86.02th

PublishedMay 11, 2021

Last ModifiedOct 30, 2025

Vulnerability Description

HTTP Protocol Stack Remote Code Execution Vulnerability

Affected Platforms (CPE)

💻

Microsoft

Windows 10 2004

< 10.0.19041.982

💻

Microsoft

Windows 10 20h2

< 10.0.19042.982

💻

Microsoft

Windows Server 2004

< 10.0.19041.982

💻

Microsoft

Windows Server 20h2

< 10.0.19042.982

References & Advisories

🔗 http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote-Code-Execution.html

🔗 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31166

🔗 http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote-Code-Execution.html

🔗 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31166

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31166

Related Vulnerabilities

CVE-2007-006510.0

Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1...

CVE-2007-22249.3

Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004...

CVE-2006-13119.3

The RichEdit component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1; Office 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for...

CVE-2008-44739.3

Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 allow remote attackers to execut...