⚠ Actively exploited
Added to CISA KEV on 2022-05-23. Federal agencies required to patch by 2022-06-13. Required action: Apply updates per vendor instructions..

CVE-2019-0880 — Microsoft Windows vulnerability

17 documents12 sources
Severity
7.8HIGHNVD
EPSS
4.1%
top 11.43%
CISA KEV
KEV
Added 2022-05-23
Due 2022-06-13
Exploit
Exploited in wild
Active exploitation observed
Affected products
21
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+18 more
Timeline
PublishedJul 15
KEV addedMay 23
Latest updateMay 24
KEV dueJun 13
CISA Required Action: Apply updates per vendor instructions.

Description

A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages21 packages

▶CVEListV5microsoft/windows18 versions+17
▶CVEListV5microsoft/windows_server9 versions+8

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-5c53-gj37-m7jp: A local elevation of privilege vulnerability exists in how splwow64↗2022-05-24
▶
Project0
Déjà vu-lnerability - Project Zero↗2021-02-01
▶
Project0
Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019 - Project Zero↗2020-07-01
▶
VulnCheck
Microsoft Windows Privilege Escalation Vulnerability↗2019
▶
Project0
Project Zero RCA: CVE-2020-0986: Windows splwow64 Untrusted Pointer Dereference↗
▶

📋Vendor Advisories

2
CISA
Microsoft Windows Privilege Escalation Vulnerability↗2022-05-23
▶
Microsoft
Microsoft splwow64 Elevation of Privilege Vulnerability↗2019-07-09
▶

🕵️Threat Intelligence

9
Securelist
Operation PowerFall: CVE-2020-0986 and variants↗2020-09-02
▶
Securelist
Operation PowerFall: CVE-2020-0986 and variants↗2020-09-02
▶
Fortinet
November Patch Tuesday↗2019-11-12
▶
Krebs
Patch Tuesday Lowdown, July 2019 Edition↗2019-07-13
▶
Qualys
July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns | Qualys↗2019-07-09
▶
CVE-2019-0880 — Microsoft Windows vulnerability | cvebase