---
id: "CVE-2019-0803"
kind: "vulnerability"
aliases: ["CVE-2019-0803"]
title: "Microsoft Win32k: Microsoft Win32k Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.4523
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Win32k", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "ransomware", "windows"]
not_affected_if: ["patched-systems"]
published_at: "2019-04-09T21:29:01+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0803", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-0803", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0803", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Microsoft Win32k: Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k, the Windows kernel graphics driver, mishandles objects in memory, which allows privilege escalation. A local attacker who can already run code on a Windows machine can gain kernel-mode code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Win32k affected ? fixed ?

## Fix

Apply the Microsoft security update for CVE-2019-0803 per vendor instructions (CISA required action); the specific KB number is unknown from these sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0803
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-0803
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-0803

## From the sources

Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_