Microsoft · Win32k
CVE-2019-0808
Microsoft Win32k Privilege Escalation Vulnerability
What it is
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.
CISA: Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 22, 2023 | Privilege Escalation | Win32k | High 7.8 | 14% |
| May 9, 2023 | Privilege Escalation | Win32k | High 7.8 | 41% |
| May 25, 2022 | Privilege Escalation | Win32k | High 8.8 | 15% |
| May 23, 2022 | Privilege Escalation | Win32k | High 7.8 | 3.0% |
| May 4, 2022 | Privilege Escalation | Win32k | High 7.8 | 87% |
| Apr 25, 2022 | Privilege Escalation | Win32k | High 7.8 | 1.6% |
| Apr 25, 2022 | Privilege Escalation | Win32k | High 7.8 | 1.6% |
| Mar 28, 2022 | Privilege Escalation | Win32k | High 7.8 | 39% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.