CVE-2019-0859
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2019-0859 is a high-severity elevation of privilege vulnerability in Windows that exists when the Win32k component fails to properly handle objects in memory, published by Microsoft as the "Win32k Elevation of Privilege Vulnerability". A local attacker holding a low-privileged account can exploit it to obtain SYSTEM-level control of the machine. The flaw affects Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 1809, and Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019 and the 1709 and 1803 server releases. Microsoft notes that this CVE ID is unique from CVE-2019-0685 and CVE-2019-0803, two other Win32k issues fixed in the same period. CVE-2019-0859 carries a CVSS score of 7.8, an EPSS score of roughly 4% at the 90th percentile, and CISA has confirmed its use in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1709 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0859(US Government Resource)
Weakness Type
No CWE classification has been assigned to CVE-2019-0859 in the vulnerability data; Microsoft's advisory describes the condition rather than assigning a formal weakness class. The description is nonetheless specific: the Win32k component fails to properly handle objects in memory. That phrasing denotes the family of memory-object lifetime and state errors — use-after-free, type confusion and related conditions — in which the kernel operates on an object whose state no longer matches its assumptions. Because Win32k runs in kernel mode and its object-handling routines are reachable from every user process, an error of this kind translates directly into an attacker-controllable kernel memory condition and from there into privileged execution.
Impact Analysis
CVE-2019-0859 requires local access and low privileges, with low attack complexity and no user interaction — an attacker who already runs code as an ordinary user, via a phishing payload, a compromised service account or a browser exploit, needs nothing more. The result is high impact to confidentiality, integrity and availability: elevation to SYSTEM exposes all data on the host, allows endpoint protection to be disabled and credentials to be dumped, enables persistence, and on a domain-joined machine opens the path to lateral movement. CISA confirms use in ransomware campaigns, which is the operationally decisive fact — this vulnerability was first observed as a zero-day used by a targeted attacker and has since become a commodity escalation step, the bridge between initial execution and the SYSTEM rights needed to delete shadow copies, stop backup services and encrypt broadly. The CVSS 3.1 base score of 7.8 states the technical severity; the EPSS score of about 4% in the 90th percentile is high for a local privilege escalation, since EPSS models internet-facing scanning that does not apply here.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-0859 and flags it as known to be used in ransomware campaigns, the KEV catalog's most serious classification. The EPSS score of roughly 4%, in the 90th percentile, is high for a vulnerability requiring local access, because EPSS is driven by internet-facing exploitation signals that have no bearing on a bug needing prior code execution — a value at this percentile indicates the exploit is in ongoing practical use rather than archived. No public exploit appears among the available references and Microsoft's MSRC entry is the only vendor source, but Win32k elevation vulnerabilities of this era are exhaustively documented in public kernel-exploitation research, and this one was originally identified through in-the-wild attack activity. With a remediation deadline that expired in 2022, confirmed ransomware use, and a large affected population of end-of-life Windows versions that can never be patched, an unpatched affected host should be treated as fully escalatable by any attacker who lands user-level code on it.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with Microsoft's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 3 May 2022 has long passed and the entry is flagged for known ransomware use.
- Install the Microsoft security update from the MSRC advisory for CVE-2019-0859. The April 2019 update addresses this issue across all affected platforms; while patching, also confirm that the related Win32k fixes for CVE-2019-0685 and CVE-2019-0803 are installed, since Microsoft fixed the three together and a system missing one is likely missing the others.
- Replace or isolate the end-of-life systems. Windows 7, 8.1, RT 8.1, Server 2008 and 2008 R2, the 1709 and 1803 server releases and the early Windows 10 branches no longer receive security servicing, so for those the remedy is migration to a supported release, or — where that is genuinely impossible — isolation from the network and from removable media.
- Find the machines that never received the update. A patch from 2019 still outstanding points to a systems-management gap rather than a deferral: audit for devices outside patch management, offline or rarely booted systems, lab and OT hosts, appliance-embedded Windows and dormant virtual machines, and prioritise multi-user systems such as terminal servers, VDI hosts and jump servers where untrusted users execute code.
- Detect exploitation and prepare for the ransomware scenario. Use EDR telemetry to alert on processes acquiring SYSTEM integrity from standard-user parents and on repeated
win32k.syscrashes, which typically precede a successful kernel exploit; watch for shadow copy deletion and security service tampering as pre-encryption indicators; and given the confirmed ransomware association, verify that offline, tested and restorable backups exist for every affected system.
Technical Details
CVE-2019-0859 is an elevation of privilege vulnerability arising from the Win32k component failing to properly handle objects in memory. Win32k implements the Windows window manager and graphics device interface inside the kernel, and its object-handling routines are invoked through system calls available to every user-mode process — so a lifetime or state error in those routines is reachable without any privilege and corrupts memory in kernel context. An attacker shapes that corrupted kernel state into arbitrary read and write primitives and from there into execution with SYSTEM privileges. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H records a local attack with low complexity and low privileges, requiring no user interaction, with complete impact on confidentiality, integrity and availability at unchanged scope. No CWE has been assigned in the vulnerability data. Microsoft explicitly distinguishes this CVE from CVE-2019-0685 and CVE-2019-0803, a reminder that Win32k produced several distinct elevation flaws in the same servicing window and that patching one does not address the others.
Frequently Asked Questions
Is CVE-2019-0859 being actively exploited?
Yes, and CISA has confirmed its use in ransomware campaigns — the KEV ransomware flag is set to "Known". Its EPSS score of about 4% places it in the 90th percentile, which is high for a local privilege escalation given that EPSS models internet-facing scanning, and indicates the exploit remains in practical use.
What products are affected by CVE-2019-0859?
Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507, 1607, 1703, 1709, 1803 and 1809, and Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019 and the 1709 and 1803 server releases are all affected. The vulnerable component is Win32k, present by default on every one of them.
How do I fix CVE-2019-0859?
Install the Microsoft security update referenced in the MSRC advisory for CVE-2019-0859, and confirm that the related Win32k fixes for CVE-2019-0685 and CVE-2019-0803 are also installed. Many affected platforms are now end-of-life and receive no updates, so for Windows 7, 8.1, Server 2008 and 2008 R2 and the early Windows 10 branches, migration to a supported release or network isolation is the real remedy.
How severe is CVE-2019-0859?
CVE-2019-0859 is rated High with a CVSS 3.1 base score of 7.8. It requires local access and low privileges rather than remote reachability, but needs no user interaction and grants SYSTEM-level control of the host with full confidentiality, integrity and availability impact; with confirmed use in ransomware campaigns and an EPSS score in the 90th percentile, it remains a high-priority patch wherever it is still outstanding.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.