Windows HTTP.sys
CVE-2021-31166 — HTTP Protocol Stack Remote Code Execution Vulnerability
Executive Summary
None
Overview
9.8
CVSS CRITICAL
Critical
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 8.5
EPSS Score
0.99657
probability of exploitation in the next 30 days
0.99949 percentile - updated 2026-08-14
View on FIRST.org
Affected Products
7 affected products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 Version 2004 for 32-bit Systems | 5003173 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 2004 for ARM64-based Systems | 5003173 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 2004 for x64-based Systems | 5003173 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 20H2 for 32-bit Systems | 5003173 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 20H2 for ARM64-based Systems | 5003173 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows Server, version 2004 (Server Core installation) | 5003173 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows Server, version 20H2 (Server Core Installation) | 5003173 (Security Update) |
Critical | Remote Code Execution | Yes |
Patches
1 patch
| Article | Type | Restart |
|---|---|---|
5003173 |
Security Update | Yes |
Exploits & PoC
11 public PoCsUnverified third-party code
Public proof-of-concept repositories aggregated from PoC-in-GitHub. They are not reviewed and may be incomplete, non-functional, or malicious — inspect the code before running anything.
| Repository | Stars | Published | Description |
|---|---|---|---|
| 0vercl0k/CVE-2021-31166 | 827 | 2021-05-16 | Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. |
| ZZ-SOCMAP/CVE-2021-31166 | 19 | 2021-09-27 | Windows HTTP协议栈远程代码执行漏洞 CVE-2021-31166 |
| corelight/CVE-2021-31166 | 12 | 2021-05-17 | HTTP Protocol Stack CVE-2021-31166 |
| zha0gongz1/CVE-2021-31166 | 9 | 2021-05-17 | PoC for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. Although it was defined as remote command execution, it can only cause the system to crash. |
| 0xmaximus/Home-Demolisher | 8 | 2022-11-22 | PoC for CVE-2021-31166 and CVE-2022-21907 |
| y0g3sh-99/CVE-2021-31166-Exploit | 7 | 2021-07-03 | Exploit for MS Http Protocol Stack RCE vulnerability (CVE-2021-31166) |
| mauricelambert/CVE-2021-31166 | 6 | 2022-03-07 | CVE-2021-31166: exploitation with Powershell, Python, Ruby, NMAP and Metasploit. |
| zecopro/CVE-2021-31166 | 5 | 2021-05-19 | simple bash script for exploit CVE-2021-31166 |
| mvlnetdev/CVE-2021-31166-detection-rules | 3 | 2021-05-17 | Different rules to detect if CVE-2021-31166 is being exploited |
| iranzai/CVE-2021-31166-exploit | 2 | 2021-10-20 | Just a simple CVE-2021-31166 exploit tool |
| bgsilvait/WIn-CVE-2021-31166 | 0 | 2021-05-23 |
Detection Rules
No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.
Acknowledgments
Microsoft Platform Security & Vulnerability Research
References
On This Page