CVE-2019-0859
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2019-0859 is a high-severity privilege escalation vulnerability in the Microsoft Windows Win32k component. The Win32k kernel-mode driver fails to properly handle objects in memory, allowing a locally authenticated attacker to run arbitrary code in kernel mode. Successful exploitation grants the attacker full control over the affected system. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 9.88% (92.9th percentile), there is a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1709 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0859(US Government Resource)
Weakness Type
CWE-NVD-noinfo
The specific weakness type for this vulnerability has not been formally classified by NVD. Based on the vulnerability description, the Win32k component improperly handles objects in memory, which is consistent with a memory corruption or improper resource management class of vulnerabilities that enables privilege escalation from user mode to kernel mode.
Impact Analysis
CVE-2019-0859 carries a CVSS 3.1 score of 7.8 (HIGH), indicating a significant local privilege escalation threat. The vulnerability requires local access with low-level privileges to exploit, but no user interaction is needed, making it easily exploitable once an attacker gains initial access to a system. Confidentiality (High): An attacker achieving kernel-mode execution can access all system memory, including credentials, encryption keys, and sensitive process data. Integrity (High): Kernel-mode code execution allows the attacker to modify any system component, install rootkits, disable security software, and alter audit logs. Availability (High): Full kernel control enables the attacker to crash the system, corrupt critical data structures, or render the system permanently inoperable. The EPSS score of 9.88% places this vulnerability in the 92.9th percentile, confirming that exploitation activity is widespread and that this vulnerability is a common target for post-compromise privilege escalation. This CVE is unique from CVE-2019-0685 and CVE-2019-0803, which are related Win32k privilege escalation vulnerabilities.
Exploit Maturity
CVE-2019-0859 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 9.88% (92.9th percentile) indicates a high probability of exploitation, placing it well above the threshold for active targeting. While no public exploit code was identified in the available references, the KEV listing and high EPSS score confirm that reliable exploitation techniques are available to threat actors. This vulnerability is part of a series of Win32k privilege escalation flaws (CVE-2019-0685, CVE-2019-0803) that are commonly chained with remote code execution vulnerabilities to achieve full system compromise.
Remediation
- Apply vendor security updates immediately as required by the CISA KEV directive: Apply updates per vendor instructions. The remediation deadline was 2022-05-03.
- Update all affected Windows systems to the latest cumulative security patches. Affected products include Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507, 1607, 1703, 1709, 1803, 1809), and Windows Server 2008 (including R2), 2012 (including R2), 2016, 2019, 1709, and 1803.
- Enforce the principle of least privilege across all endpoints, ensuring that standard user accounts do not have unnecessary administrative privileges that could amplify the impact of exploitation.
- Deploy endpoint detection and response (EDR) solutions configured to detect Win32k exploitation patterns, including suspicious kernel-mode transitions, unexpected privilege changes, and anomalous system call sequences.
- Conduct retroactive threat hunting on systems that may have been exposed before patching, looking for indicators of privilege escalation such as unauthorized SYSTEM-level processes, new scheduled tasks, or modified security policies.
Technical Details
CVE-2019-0859 is a privilege escalation vulnerability in the Windows Win32k kernel-mode driver that occurs when the component fails to properly handle objects in memory. The Win32k driver is responsible for window management and GDI (Graphics Device Interface) operations in the Windows kernel. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that exploitation requires local access and low privileges with no user interaction. By manipulating memory objects handled by Win32k, an attacker can trigger a condition that allows arbitrary code execution in kernel mode, effectively escalating from a standard user to SYSTEM-level privileges. The scope remains unchanged, meaning the impact is confined to the vulnerable system, but complete compromise of that system is achievable. This vulnerability is distinct from but related to CVE-2019-0685 and CVE-2019-0803, which exploit similar Win32k memory handling weaknesses.
Frequently Asked Questions
Is CVE-2019-0859 being actively exploited?
Yes. CVE-2019-0859 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 9.88% (92.9th percentile) further confirms high exploitation probability. It is commonly used as a post-compromise privilege escalation vector.
What products are affected by CVE-2019-0859?
CVE-2019-0859 affects a wide range of Microsoft Windows products: Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507, 1607, 1703, 1709, 1803, 1809), and Windows Server 2008 (including R2), 2012 (including R2), 2016, 2019, 1709, and 1803.
How do I fix CVE-2019-0859?
Apply the security updates provided by Microsoft for all affected Windows versions. Enforce least privilege policies across all systems and deploy endpoint detection tools to monitor for Win32k exploitation attempts. Conduct threat hunting on previously exposed systems.
How severe is CVE-2019-0859?
CVE-2019-0859 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access, the low complexity and ability to achieve kernel-mode code execution make it a significant threat. The high EPSS score confirms it is actively targeted by threat actors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.