7.8high
CVE-2019-0803KEV · ransomwarein critical feed1 exploit
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
45.2%
percentile 99%
Public exploits
1
Exploit-DB
Summary
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0859.
Known exploited (CISA KEV)
- Added
- 5 y ago
- Due date
- 2022-05-03 (4 y ago)
- Ransomware use
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- Microsoft / Win32k
- CISA name
- Microsoft Win32k Privilege Escalation Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction (EPSS)
45.23% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-46920 Microsoft Windows - 'Win32k' Local Privilege Escalation · local · 2019-05-15
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Windows
- Microsoft Windows Server
References
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2019-0803 · x_refsource_MISC, x_transferred
- packetstormsecurity.com /files/153034/Microsoft-Windows-Win32k-Privilege-Escalation.html · x_refsource_MISC, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0803 · government-resource
Sources
- CVE List: CVE-2019-0803
- NVD: CVE-2019-0803
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.