CVE-2019-1458

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

74.44% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2022-01-10, used in ransomware campaigns

Published

2019-12-10

Updated

2026-08-12

Proof-of-concept exploits (5)

• http://packetstormsecurity.com/files/156651/Microsoft-Windows-WizardOpium-Local-Privilege…
• http://packetstormsecurity.com/files/159569/Microsoft-Windows-Uninitialized-Variable-Loca…
• piotrflorczyk/cve-2019-1458_POC181★ · 2022-01-17
• rip1s/CVE-2019-1458133★ · 2020-03-11
• unamer/CVE-2019-1458133★ · 2020-03-11

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2019_1458_wiza…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/48180

Exploit collections (1)

• helloexp/0day/tree/master/00-CVE_EXP/CVE-2019-1458

References

• CVE Record
• NVD entry

Related

• CVE-2017-11882
• CVE-2018-8120
• CVE-2019-14551
• CVE-2019-14656
• CVE-2019-14550
• CVE-2019-14657