{"id":"CVE-2019-0803","kind":"vulnerability","aliases":["CVE-2019-0803"],"related":[],"title":"Microsoft Win32k: Microsoft Win32k Privilege Escalation Vulnerability","description":"Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Win32k, the Windows kernel graphics driver, mishandles objects in memory, which allows privilege escalation. A local attacker who can already run code on a Windows machine can gain kernel-mode code execution.","severity":"high","cvss":7.8,"epss":0.4523,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Win32k","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","windows"],"not_affected_if":["patched-systems"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2019-0803 per vendor instructions (CISA required action); the specific KB number is unknown from these sources.","status":"open","published_at":"2019-04-09T21:29:01+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:39:29+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:39:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2019-0803 per vendor instructions (CISA required action); the specific KB number is unknown from these sources.","reach":"local","impact":"high","summary":"Microsoft Win32k, the Windows kernel graphics driver, mishandles objects in memory, which allows privilege escalation. A local attacker who can already run code on a Windows machine can gain kernel-mode code execution.","category":"infrastructure","who_cares":["windows"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker gains kernel-mode code execution and full control of the Windows machine.","analyst_note":"Find the affected Windows versions and the patch KB for CVE-2019-0803 in the Microsoft Security Update Guide; the sources give no version list.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-systems"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000462,"input_tokens":2854,"output_tokens":353,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected Windows versions and the patch KB for CVE-2019-0803 in the Microsoft Security Update Guide; the sources give no version list.","search":"'-0803':10A,13A '-2019':9A,12A 'action':86C 'allow':32B,75C 'alreadi':40B 'appli':87C 'attack':37B,77C 'caus':70C 'cisa':84C 'code':42B,52B,80C 'contain':56C 'cve':8A,11A 'driver':26B 'due':60C 'escal':6A,34B,72C 'execut':53B 'exploit':16B,74C 'fail':63C 'gain':48B 'graphic':25B 'handl':66C 'infrastructur':17B 'instruct':91C 'kernel':24B,50B,82C 'kernel-mod':49B 'local':36B 'machin':46B 'memori':30B,69C 'microsoft':1A,3A,14A,20B,54C 'mishandl':27B 'mode':51B,83C 'object':28B,67C 'per':89C 'privileg':5A,33B,71C 'proper':65C 'ransomwar':18B 'requir':85C 'run':41B,79C 'success':73C 'unspecifi':58C 'updat':88C 'vendor':90C 'vulner':7A,59C 'win32k':2A,4A,15A,21B,55C 'window':19B,23B,45B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-04-09T21:29:01+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-0803","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0803","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2019-0803","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-0803","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-0803","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0803","severity":null,"published_at":"2019-04-09T21:29:01+00:00","modified_at":"2026-06-17T02:08:56+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}