Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-0881 — Insufficiently Protected Credentials in Microsoft Windows

CWE-522 — Insufficiently Protected Credentials8 documents6 sources
Severity
7.8HIGHNVD
EPSS
4.3%
top 11.14%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
25
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+22 more
Timeline
PublishedMay 16
Latest updateMay 1

Description

An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege Vulnerability'.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages23 packages

▶CVEListV5microsoft/windows20 versions+19
▶NVDmicrosoft/windowsr2, 1709, 1803+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

4
Project0
The Windows Registry Adventure #8: Practical exploitation of hive memory corruption - Project Zero↗2025-05-01
▶
Project0
The Windows Registry Adventure #7: Attack surface analysis - Project Zero↗2025-05-01
▶
Project0
The Windows Registry Adventure #5: The regf file format - Project Zero↗2024-12-01
▶
GHSA
GHSA-chq2-xrc4-6mwv: An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege↗2022-05-24
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows 10 1809 - 'CmKeyBodyRemapToVirtualForEnum' Arbitrary Key Enumeration Privilege Escalation↗2019-05-23
▶

📋Vendor Advisories

1
Microsoft
Windows Kernel Elevation of Privilege Vulnerability↗2019-05-14
▶

💬Community

1
Bugzilla
CVE-2019-20807 vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode↗2020-06-01
▶
CVE-2019-0881 — Insufficiently Protected Credentials | cvebase