CVE-2019-0888
ActiveX Data Objects (ADO) Remote Code Execution Vulnerability
HIGH 8.8EPSS 11.1%
A remote code execution vulnerability exists in the way that ActiveX Data Objects (ADO) handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with the victim user’s privileges.An attacker could craft a website that exploits the vulnerability and then convince a victim user to visit the website.The security update addresses the vulnerability by modifying how ActiveX Data Objects handle objects in memory.
- Affected
- Microsoft · Windows 10 Version 1703 · Windows 10 Version 1803 · Windows Server, version 1803 (Server Core Installation) · Windows 10 Version 1809 · Windows Server 2019 · Windows Server 2019 (Server Core installation)
- CVSS v3.1 MICROSOFT
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.0 NVD
- 8.8 HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C - EPSS
- 11.13% chance of exploitation in the next 30 days, 96th percentile
- Published
- 2019-06-12
- Updated
- 2025-05-20
Proof-of-concept exploits (1)
- sophoslabs/CVE-2019-088839★ · 2019-07-09