CVE-2019-0797
Published: 09 April 2019
Summary
CVE-2019-0797 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10 1709. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 10.6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-16 (Memory Protection).
Deeper analysis
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. The flaw, tracked as CVE-2019-0797, affects the Win32k kernel-mode driver and carries a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It is distinct from the related Win32k issue CVE-2019-0808.
A local attacker with a low-privileged account can exploit the flaw to elevate privileges and obtain full control over the affected system, resulting in complete compromise of confidentiality, integrity, and availability. No user interaction or additional privileges beyond an initial local session are required for successful exploitation.
Microsoft has published security guidance addressing the issue at the referenced MSRC advisory, and the vulnerability appears in the CISA Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-1553
Vulnerability details
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the root cause by enforcing memory protection mechanisms that prevent Win32k from allowing improper object handling leading to kernel EoP.
Limits the initial local account to least-privilege rights, reducing both the ability to trigger the Win32k flaw and the impact of resulting full-system compromise.
Requires timely application of Microsoft patches that correct the specific Win32k memory-handling defect before in-the-wild exploitation can succeed.