# CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability

Source: https://junglewise.ai/threats/cve-2021-40444-microsoft-mshtml-remote-code-execution-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2021-40444 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2021-11-03

A remote code execution vulnerability exists in the Microsoft MSHTML browser engine when processing specially crafted Microsoft Office documents. An attacker can exploit this by tricking a user into opening a malicious document containing a crafted ActiveX control, potentially leading to full system compromise depending on user permissions.

Technologies: [Microsoft Mshtml](https://junglewise.ai/threats/technologies/mshtml). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2021-40444 exploited in the wild?** Yes. CVE-2021-40444 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

**How severe is CVE-2021-40444?** Critical severity, with a CVSS score of 8.8, published 3 November 2021.

**Which products and versions are affected?** Microsoft Windows 10 20H2, 21H1, 1607, 1809, 1909, 2004; Microsoft Windows 7 SP1; Microsoft Windows 8.1; Microsoft Windows RT 8.1; and 2 more.

**Is there a fix for CVE-2021-40444?** A patch was published on 2021-09-14: Microsoft released security updates to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-40444 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2021-40444?** Check whether you run Microsoft Mshtml. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Microsoft Windows 10 20H2, 21H1, 1607, 1809, 1909, 2004
- Microsoft Windows 7 SP1
- Microsoft Windows 8.1
- Microsoft Windows RT 8.1
- Microsoft Windows Server 2008 SP2, R2 SP1
- Microsoft MSHTML

## Timeline

- 2021-09-14: patched: Microsoft released security updates to address the vulnerability.
- 2021-11-03: disclosed: Initial publication date.
- 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
- exploited: Microsoft reported awareness of targeted attacks using specially-crafted Office documents.

## Related threats

- [Microsoft MSHTML Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2019-0541-microsoft-mshtml-remote-code-execution-vulnerability)