CVE-2019-0859
Published: 09 April 2019
Summary
CVE-2019-0859 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10 1709. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 6.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-16 (Memory Protection).
Deeper analysis
The vulnerability CVE-2019-0859 is an elevation of privilege issue affecting the Win32k component of Windows, where the software fails to properly handle objects in memory. This flaw is distinct from related issues tracked as CVE-2019-0685 and CVE-2019-0803.
A local attacker with existing low-privileged access can exploit the weakness without user interaction to obtain higher privileges on the system, resulting in full compromise of confidentiality, integrity, and availability.
Microsoft provides mitigation details and patches via its security advisory at portal.msrc.microsoft.com, while CISA lists the vulnerability in its known exploited vulnerabilities catalog, confirming real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-1610
Vulnerability details
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the EoP goal of CVE-2019-0859 by restricting processes to the minimum privileges needed, blocking the Win32k memory-object flaw from yielding SYSTEM-level access.
Addresses the root cause—improper memory-object handling inside Win32k—by enforcing OS-level memory protections that prevent corruption-based privilege escalation.
Requires timely application of the vendor patch that eliminates the Win32k memory-handling flaw listed in the CISA KEV catalog.