CVE-2021-31979

Key facts

CVSS score

7.8 (v3.1)

Severity

HIGH

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness (CWE)

CWE-119

EPSS score

4.5% (91th percentile)

In CISA KEV

Yes, added November 3, 2021

In EU EUVD

Yes (EUVD-2021-18851)

Published

July 14, 2021

NVD last modified

August 10, 2026

Status

Analyzed

Affected products

• microsoft / windows 10 1507
• microsoft / windows 10 1607
• microsoft / windows 10 1809
• microsoft / windows 10 1909
• microsoft / windows 10 2004
• microsoft / windows 10 20h2
• microsoft / windows 10 21h1
• microsoft / windows 7
• microsoft / windows 8.1
• microsoft / windows rt 8.1
• microsoft / windows server 2004
• microsoft / windows server 2008
• microsoft / windows server 2008
• microsoft / windows server 2012
• microsoft / windows server 2012
• microsoft / windows server 2016
• microsoft / windows server 2019
• microsoft / windows server 20h2

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Microsoft Windows 10 version 2004 (May 2020 Update), Microsoft Windows Server version 2004 (May 2020 Update) and others - Microsoft Corporation - Common Criteria 2020-50-INF-3671 - active
• Microsoft Windows 10 version 1909 and Microsoft Windows Server version 1909 - Microsoft Corporation - Common Criteria 2019-47-INF-3134 - archived
• Windows 7 BitLocker™ Drive Encryption - Microsoft Corporation - FIPS 140 1332 - historical
• Microsoft Windows 7 Kernel Mode Cryptographic Primitives Library (cng.sys) - Microsoft Corporation - FIPS 140 1328 - historical

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31979(Patch, Vendor Advisory)
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31979(Patch, Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31979(US Government Resource)