---
id: "CVE-2021-34448"
kind: "vulnerability"
aliases: ["CVE-2021-34448"]
title: "Microsoft Windows: Microsoft Windows Scripting Engine Memory Corruption Vulnerability"
severity: "critical"
cvss: 9.3
epss: 0.40062
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "windows"]
not_affected_if: []
published_at: "2021-07-16T21:15:09+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34448", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-34448", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34448", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Microsoft Windows: Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Microsoft Windows Scripting Engine has a memory corruption flaw that CISA lists as actively exploited. An attacker who can get the affected engine to process crafted content can corrupt memory and may run code on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?

## Fix

Apply the Microsoft Windows updates for CVE-2021-34448 per vendor instructions, as CISA requires.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34448
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-34448
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-34448

## From the sources

Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_