CVE-2019-0808
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2019-0808 is a high-severity privilege escalation vulnerability in the Microsoft Win32k component. The vulnerability exists because the Windows kernel-mode driver fails to properly handle objects in memory, allowing a locally authenticated attacker to execute arbitrary code in kernel mode. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 74.24% (98.8th percentile), CVE-2019-0808 has a very high probability of exploitation, particularly as public exploit code is available and the vulnerability affects legacy Windows systems such as Windows 7 and Windows Server 2008.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows server 2008 | -; r2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157616/Microsoft-Windows-NtUserMNDragOver-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0808(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0808(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2019-0808 has no specific CWE mapping in the NVD database. However, the underlying vulnerability relates to improper memory handling in the Win32k kernel-mode driver. When the driver fails to properly handle objects in memory, it can lead to memory corruption conditions that allow an attacker to escalate privileges from user mode to kernel mode, enabling full system compromise on affected Windows systems.
Learn more: Win32k Elevation of Privilege — Microsoft Security Advisory
Impact Analysis
CVE-2019-0808 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a significant privilege escalation threat on affected Windows systems. The vulnerability requires local access and low-level privileges to exploit, but no user interaction is needed, making it suitable for chaining with browser or document-based vulnerabilities for initial access. Confidentiality (High): An attacker who escalates to kernel mode gains full read access to all system data, including credentials and sensitive files. Integrity (High): Kernel-mode execution allows arbitrary modification of system files, security configurations, and running processes. Availability (High): Full system compromise can lead to denial of service or the deployment of persistent malware. The EPSS score of 74.24% places this vulnerability in the 98.8th percentile, indicating very high exploitation probability among known vulnerabilities.
Exploit Maturity
CVE-2019-0808 has a mature and well-documented exploit landscape. Public exploit code is available via Packet Storm Security, which demonstrates the NtUserMNDragOver local privilege escalation technique targeting the Win32k driver. CISA has confirmed active exploitation in the wild by including this vulnerability in its Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 74.24% (98.8th percentile) indicates a very high likelihood of exploitation. This vulnerability was notably used in conjunction with a Google Chrome zero-day (CVE-2019-5786) in targeted attacks, where the browser exploit provided initial code execution and CVE-2019-0808 was chained for kernel-level privilege escalation.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft has released security updates for all affected Windows versions.
- Verify that all instances of affected products (Windows 7 and Windows Server 2008, including R2 variants) have been updated to the latest patched versions. Given these are end-of-life products, consider migrating to supported Windows versions.
- If immediate patching is not feasible, implement strict local access controls to reduce the attack surface. Limit local logon privileges to essential accounts only and enforce the principle of least privilege across all systems.
- Monitor for indicators of privilege escalation attempts, including unusual kernel-mode activity, suspicious NtUserMNDragOver calls, and unexpected SYSTEM-level process creation from low-privilege user accounts.
- Deploy endpoint detection and response (EDR) solutions capable of detecting kernel exploit techniques, and ensure that Windows Defender Credential Guard or similar kernel integrity protections are enabled where supported.
Technical Details
CVE-2019-0808 targets the Win32k component of the Windows kernel-mode driver, specifically the NtUserMNDragOver function that improperly handles objects in memory. The vulnerability allows a locally authenticated attacker to trigger a memory corruption condition in the kernel, resulting in arbitrary code execution at the highest privilege level (Ring 0). The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires local access with low privileges but no user interaction, with high impact across all three security objectives. This vulnerability is distinct from CVE-2019-0797, another Win32k elevation of privilege flaw patched in the same timeframe, and was specifically weaponized alongside browser zero-days for full attack chains against Windows 7 systems.
Frequently Asked Questions
Is CVE-2019-0808 being actively exploited?
Yes. CVE-2019-0808 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 74.24% (98.8th percentile) further indicates a very high exploitation probability. Public exploit code is available, and this vulnerability was used in real-world attacks chained with browser zero-days.
What products are affected by CVE-2019-0808?
CVE-2019-0808 affects Microsoft Windows 7 and Windows Server 2008 (including R2 variants). These are legacy operating systems that have reached end of life, making migration to supported Windows versions the recommended long-term strategy.
How do I fix CVE-2019-0808?
Apply the security updates provided by Microsoft. Since the affected products (Windows 7 and Windows Server 2008) are end-of-life, organizations should prioritize migrating to supported Windows versions. In the interim, restrict local access privileges and deploy EDR solutions to detect exploitation attempts.
How severe is CVE-2019-0808?
CVE-2019-0808 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access, its low attack complexity and high impact across confidentiality, integrity, and availability make it a significant threat, especially when chained with remote code execution vulnerabilities for full system compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.