{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3omicrosoftwindows_102004/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2021-31166"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows 10 2004 (\u003c 10.0.19041.982)","Windows 10 20H2 (\u003c 10.0.19042.982)","Windows Server 2004 (\u003c 10.0.19041.982)","Windows Server 20H2 (\u003c 10.0.19042.982)"],"_cs_severities":["high"],"_cs_tags":["windows","rce","vulnerability","http-protocol-stack"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCVE-2021-31166 is a critical use-after-free vulnerability located in the Windows \u003ccode\u003ehttp.sys\u003c/code\u003e driver, which handles HTTP requests. Successful exploitation allows an unauthenticated, remote attacker to execute arbitrary code on the target system. The vulnerability was initially patched in May 2021. Recent activity involves the publication of functional proof-of-concept code that utilizes a specifically crafted \u003ccode\u003eAccept-Encoding\u003c/code\u003e header to trigger the flaw.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full system compromise, providing the attacker with the same privileges as the \u003ccode\u003ehttp.sys\u003c/code\u003e driver (typically \u003ccode\u003eSYSTEM\u003c/code\u003e level). This impact is confirmed for unpatched versions of Windows 10 and Windows Server 2004/20H2.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePerform an immediate inventory of Windows systems to identify any running instances of the affected Windows 10 or Server versions (2004/20H2) that remain unpatched.\u003c/li\u003e\n\u003cli\u003eEnsure all systems are updated to the security patch level released in May 2021 or later.\u003c/li\u003e\n\u003cli\u003eFor internet-facing systems that cannot be patched immediately, deploy the provided WAF block logic to inspect and drop incoming HTTP requests containing the specific \u003ccode\u003eAccept-Encoding: doar-e, ftw, imo, ,\u003c/code\u003e header string.\u003c/li\u003e\n\u003cli\u003eImplement the detection rule below to monitor for malicious header patterns in web server logs.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-27T09:20:32Z","date_published":"2026-10-27T09:20:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2021-31166/","summary":"A public proof-of-concept exploit for CVE-2021-31166, a use-after-free vulnerability in the Windows http.sys driver, demonstrates remote code execution via a malformed Accept-Encoding header.","title":"Microsoft Windows: http.sys use-after-free remote code execution (CVE-2021-31166)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2021-31166/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}