CVE-2019-0880
Microsoft Windows Privilege Escalation Vulnerability
Description
CVE-2019-0880 is a local elevation of privilege vulnerability in Windows caused by how the splwow64.exe process handles certain calls. This flaw allows an attacker who has already gained low-integrity access to a system to escalate their privileges to medium-integrity, expanding their ability to access protected resources and execute additional attacks. CISA has confirmed active exploitation of CVE-2019-0880 by including it in the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS percentile of 88.4%, this vulnerability is frequently exploited as a stepping stone in multi-stage attack chains targeting Windows systems.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1903 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1903 | - |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0880(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0880(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes weaknesses where a product fails to properly assign, modify, track, or check privileges, allowing an actor to gain more access than intended. In CVE-2019-0880, the splwow64.exe process improperly handles certain calls in a way that allows a low-integrity attacker to escalate to medium-integrity privileges, bypassing Windows integrity level enforcement.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2019-0880 is a local elevation of privilege vulnerability that allows an attacker to escalate from low-integrity to medium-integrity execution on a Windows system. While this escalation may appear modest compared to full SYSTEM-level privilege gains, the transition from low to medium integrity is tactically significant in Windows attack chains. Low-integrity processes are severely restricted — they cannot write to most file system locations, modify registry keys, or interact with user-level processes. Escalating to medium integrity grants access to the user's profile, documents, and the ability to interact with other user-level applications, significantly expanding the attacker's capabilities. The EPSS percentile of 88.4% indicates a high probability of active exploitation. This vulnerability is particularly valuable to attackers who have achieved initial code execution through browser exploits, sandboxed application escapes, or other vectors that result in low-integrity execution, as it provides the privilege elevation needed to continue the attack chain.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-0880 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 88.4% reflects significant real-world exploitation activity. The vulnerability in splwow64.exe — the Windows print spooler thunking component for 64-bit systems — represents a reliable privilege escalation primitive that attackers use after gaining initial low-integrity code execution. This type of integrity level escalation is commonly chained with browser vulnerabilities, document-based exploits, or other initial access vectors to transition from a sandboxed or low-privilege context to one capable of broader system interaction.
Remediation
- Apply the security updates provided by Microsoft for the affected Windows versions as specified in the associated security advisory. CISA mandates remediation by June 13, 2022.
- Monitor the splwow64.exe process for anomalous behavior, including unexpected call patterns or interactions with processes at different integrity levels that may indicate exploitation attempts.
- Implement application whitelisting and process execution restrictions to limit the ability of low-integrity processes to interact with system components like splwow64.exe.
- Deploy endpoint detection and response (EDR) solutions configured to alert on integrity level transitions, which is a key indicator of privilege escalation activity.
- Review and harden print spooler configurations across the environment, as the splwow64.exe component is related to print spooler functionality and multiple print spooler vulnerabilities have been discovered historically.
Technical Details
CVE-2019-0880 exploits a flaw in splwow64.exe, the Windows print spooler thunking process responsible for handling 32-bit print driver calls on 64-bit Windows systems. The vulnerability arises from how splwow64.exe processes certain inter-process communication (IPC) calls. When a low-integrity process sends specific requests to splwow64.exe, the process fails to properly validate the caller's integrity level or enforce appropriate access controls on the requested operations. This allows an attacker running code at low integrity to leverage splwow64.exe — which runs at medium integrity — to perform actions at the medium-integrity level on the attacker's behalf. The result is an integrity level escalation from low to medium, which in Windows Mandatory Integrity Control represents a meaningful privilege boundary. The attack is local in nature and requires the attacker to already have code execution at low integrity on the target system, making it a second-stage exploit typically chained after an initial access vector.
Frequently Asked Questions
Is CVE-2019-0880 being actively exploited?
Yes, CVE-2019-0880 is being actively exploited. CISA has included it in the Known Exploited Vulnerabilities catalog. The EPSS percentile of 88.4% confirms high exploitation likelihood, and the vulnerability is commonly used in multi-stage attack chains.
What products are affected by CVE-2019-0880?
CVE-2019-0880 affects the splwow64.exe component in Microsoft Windows. This component is present on 64-bit Windows systems that support 32-bit print drivers. Administrators should consult Microsoft's security advisory for the specific affected Windows versions.
How do I fix CVE-2019-0880?
Apply Microsoft's security updates for the affected Windows versions. Additionally, monitor splwow64.exe for anomalous behavior and deploy EDR solutions capable of detecting integrity level transitions that indicate privilege escalation attempts.
How severe is CVE-2019-0880?
CVE-2019-0880 enables escalation from low to medium integrity on Windows, which is a tactically significant privilege boundary. Its EPSS percentile of 88.4% indicates high exploitation activity. While not a full SYSTEM escalation, it is a critical link in attack chains that start from sandboxed or low-privilege contexts.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.