CVE-2019-0880
Published: 15 July 2019
Summary
CVE-2019-0880 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10 1709. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 11.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. The affected component is splwow64.exe, a 64-bit helper process used by the Windows print spooler. The flaw carries a CVSS 3.1 base score of 7.8 and is tracked as CVE-2019-0880.
An attacker with local access and low privileges can invoke the vulnerable code path without user interaction, resulting in elevation to higher privileges that allow full control over confidentiality, integrity, and availability on the affected system. Exploitation occurs entirely locally and does not require network access or elevated rights to begin.
Microsoft published an advisory detailing the issue and corresponding security updates. The vulnerability also appears in CISA’s catalog of known exploited vulnerabilities, confirming observed in-the-wild use and underscoring the need to apply the vendor patches promptly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-1629
Vulnerability details
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.
- CWE(s)
- KEV Date Added
- 23 May 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor security update that patches the flaw in splwow64.exe before local low-privileged callers can exploit the elevation path.
Enforces that user accounts and processes interacting with the print spooler receive only the minimum privileges needed, reducing the starting rights an attacker can leverage for elevation via CVE-2019-0880.
Limits activation and exposure of non-essential components such as the print spooler and its splwow64 helper, shrinking the local attack surface that the vulnerability depends on.