CVE-2021-31961: 
vulnerability analysis and mitigation

CVE-2021-31961 is a Windows InstallService Time-Of-Check Time-Of-Use (TOCTOU) vulnerability that affects Microsoft Windows installations. The vulnerability was discovered and reported to Microsoft on February 8, 2021, and was publicly disclosed on July 19, 2021 (ZDI Advisory).

The vulnerability exists within the Microsoft Store Install Service and stems from the lack of proper locking when performing operations on a file. The vulnerability has been assigned a CVSS score of 6.1 with the following vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H (ZDI Advisory).

When successfully exploited, this vulnerability can allow local attackers to create a denial-of-service condition on affected installations of Microsoft Windows (ZDI Advisory).

To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. The vulnerability can then be leveraged to create a denial-of-service condition on the system (ZDI Advisory).

Microsoft has released a security update to address this vulnerability. Users are advised to apply the available patches through the official Microsoft update channels (ZDI Advisory).