CVE-2021-43890
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedWe have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. December 27 2023 Update: In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceA spoofing vulnerability in the Windows AppX/App Installer allows attackers to craft malicious AppX packages that can be delivered via phishing emails. Attackers leverage the ms-appinstaller URI scheme to trick users into installing malware families including Emotet, Trickbot, and Bazaloader. The vulnerability enables remote code execution when users open specially crafted malicious attachments.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 1.16< 1.11CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- High
- Privileges
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Verify App Installer versionOpen PowerShell and run: Get-AppxPackage Microsoft.AppInstaller | Select-Object Name, VersionAffected if The installed version is lower than 1.16.0 or lower than 1.11.0 (depending on your update channel) - you are running a vulnerable version.
-
Confirm ms-appinstaller protocol handler existsOpen PowerShell and run: Get-ItemProperty 'HKCR:\ms-appinstaller' -ErrorAction SilentlyContinueAffected if The registry key exists, meaning the ms-appinstaller protocol handler is registered on the system.
-
Check if protocol handler is enabledRun: Get-ItemProperty 'HKCU:\Software\Classes\ms-appinstaller' -ErrorAction SilentlyContinue OR check 'HKLM:\Software\Policies\Microsoft\Windows\AppInstaller' for EnableAppInstaller settingAffected if No DisableGameAppInstaller or EnableAppInstaller=0 registry key is present, indicating the protocol is active.
-
Verify App Installer service configurationRun: Get-Service AppInstaller -ErrorAction SilentlyContinue (or check related Windows services)Affected if The App Installer service exists and is not explicitly disabled.
-
Check for recent App Installer package installationsReview Windows Event Logs under Microsoft-Windows-AppXDeploymentServer for AppInstaller package operations within the last 30 daysAffected if Any recent AppInstaller package installations from external/unknown sources are observed, indicating potential exploitation.
You are affected if App Installer version is below 1.16/1.11 AND the ms-appinstaller protocol handler is registered and enabled on your system.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped1.111.16
Apply Microsoft security updates for App Installer. Alternatively, disable the ms-appinstaller protocol via Group Policy or registry settings. Users should be trained to avoid opening unsolicited attachments, especially .appx or .msix files.
App Installer version 1.16 or later (or version 1.11 or later for the older release track)
- 1. Open Microsoft Store or use the Windows Update mechanism to check for and install the latest version of App Installer.
- 2. Alternatively, download the latest App Installer from the official Microsoft Store page.
- 3. After updating, verify the version by opening the App Installer app and checking About/Version information.
- 4. For additional security as recommended in the December 2023 update, consider disabling the ms-appinstaller URI scheme via group policy or registry settings if not already disabled by default in your version.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-43890 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-43890 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data