CVE-2021-37852: LPE in ESET products for Windows

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-09 · updated 2026-06-17
Weakness: CWE-269

Description

ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.

Affected products

ESET Endpoint Antivirus: from 6.6.2046.0 before 7.3.2055.0; from 8.0 before 8.0.2028.3; from 8.1 before 8.1.2031.4; from 9.0 before 9.0.2032.6 — fixed in 7.3.2055.0, 8.0.2028.3, 8.1.2031.4, 9.0.2032.6
ESET Endpoint Security: from 6.6.2046.0 before 7.3.2055.0; from 8.0 before 8.0.2028.3; from 8.1 before 8.1.2031.4; from 9.0 before 9.0.2032.6 — fixed in 7.3.2055.0, 8.0.2028.3, 8.1.2031.4, 9.0.2032.6
ESET File Security: from 7.0.12014.0 through 7.3.12006.0
ESET Internet Security: from 10.0.337.1 before 15.0.18.0 — fixed in 15.0.18.0
ESET Mail Security: from 7.0.10019 before 7.3.10014.0; from 7.0.14008.0 before 7.3.14003.0; from 8.0 before 8.0.14006.0; from 8.0.10012.0 before 8.0.10018.0 — fixed in 7.3.10014.0, 7.3.14003.0, 8.0.10018.0, 8.0.14006.0
ESET Nod32 Antivirus: from 10.0.337.1 through 15.0.18.0
ESET Security: from 7.0.15008.0 through 8.0.15004.0
ESET Server Security: from 7.0.12016.1002 through 7.2.12004.1000; 8.0.12003.0, 8.0.12003.1
ESET Smart Security: from 10.0.337.1 through 15.0.18.0

How to fix

Upgrade to a fixed version: ESET Endpoint Antivirus 7.3.2055.0, 8.0.2028.3, 8.1.2031.4, 9.0.2032.6; ESET Endpoint Security 7.3.2055.0, 8.0.2028.3, 8.1.2031.4, 9.0.2032.6; ESET Internet Security 15.0.18.0; ESET Mail Security 7.3.10014.0, 7.3.14003.0, 8.0.10018.0, 8.0.14006.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-37852 or the next vulnerability affects your stack