Loading vulnerability…
CVE-2021-31956 is a local elevation-of-privilege vulnerability in the Windows NTFS kernel driver, ntfs.sys. Available technical reporting describes it as a heap-based or paged-pool buffer overflow in NTFS extended attribute handling, specifically in NtfsQueryEaUserEaList, caused by improper handling of an integer underflow during output buffer length validation. Exploitation can be triggered via NTFS extended attribute operations, including use of NtSetEAFile and NtQueryEaFile. Public analyses describe attackers combining the corruption with Windows Notification Facility object spraying to obtain relative and then arbitrary kernel memory read/write primitives, followed by manipulation of kernel structures to steal the SYSTEM token of the System process. The vulnerability was observed in the wild as part of exploit chains used to escape a Chromium sandbox and obtain full system privileges on supported Windows 10 builds.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a Proof-of-Concept (PoC) exploit for CVE-2021-31956, a Windows kernel (NTFS) local privilege escalation vulnerability. The code is written in C++ and structured as a Visual Studio project. The main exploit logic resides in '31956Custom/Main.cpp', which orchestrates the attack by: - Initializing access to undocumented NT* API functions from ntdll.dll. - Leaking the EPROCESS address of the current process using a technique related to CVE-2021-31955 (Superfetch/SysInfo leak). - Crafting a file ('TriggerBug') with specific NTFS extended attributes to trigger a heap overflow in the kernel. - Corrupting WNF (Windows Notification Facility) state data structures in kernel memory to gain arbitrary read/write capabilities. - Stealing the SYSTEM token from the SYSTEM process and assigning it to the current process, then spawning a SYSTEM shell (cmd.exe). The exploit is highly dependent on hardcoded kernel structure offsets, which may need adjustment for different Windows builds. The README notes that the exploit is a work-in-progress and may destabilize the system (potential for BSOD or instability after use). The code does not target remote or network endpoints; it is strictly a local privilege escalation exploit. The repository includes references to related research and prior PoCs for both CVE-2021-31956 and CVE-2021-31955.
This repository contains a local privilege escalation exploit for CVE-2021-31956, targeting Microsoft Windows 10 20H2. The main exploit logic is implemented in 'CVE-2021-31956.c', with supporting structures and definitions in 'CVE-2021-31956.h'. The exploit leverages a heap overflow in the Windows Notification Facility (WNF) to manipulate kernel memory and ultimately steal the SYSTEM process token, granting the attacker SYSTEM privileges. The exploit is operational and requires local execution on a vulnerable Windows system. The README notes that the user must specify a writable directory for file operations, and that the exploit will create a new console window. The repository includes Visual Studio project files for building the exploit. No network endpoints are involved; the attack vector is purely local. The exploit is not part of a framework and is a standalone proof-of-concept with a working privilege escalation payload.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windows kernel paged pool buffer overflow vulnerability used for sandbox escape and privilege escalation to SYSTEM as part of Magnitude's Chromium exploit chain.
A local privilege escalation vulnerability in the Windows kernel (NTFS Paged Pool Memory corruption).
A heap-based buffer overflow vulnerability in Windows ntfs.sys that can be exploited for elevation of privilege by creating arbitrary kernel memory read/write primitives.
A Windows NTFS elevation-of-privilege zero-day used in the wild as part of an exploit chain to escape the sandbox and gain system privileges on modern Windows 10 systems.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.