CVE-2019-0859

CVE-2019-0859 is an elevation of privilege vulnerability in the Win32k kernel component of Microsoft Windows, caused by the component failing to properly handle objects in memory. It is exploited locally: a low-privileged user or process already running on the machine can trigger the mishandling with no user interaction required, per the CVSS vector (AV:L/PR:L/UI:N). Successful exploitation elevates the attacker to kernel privileges, with high impact to confidentiality, integrity and availability, typically used to break out of user-level restrictions after an initial foothold. Any unpatched Windows 7, 8.1, RT 8.1, Windows 10 versions 1507 through 1809, or Windows Server 2008, 1709, or 1803 system is affected; the flaw was fixed in Microsoft's April 2019 security updates. It was reported as actively exploited when patched, was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, and carries an EPSS of 4.2% (90th percentile); no public PoC is known.

What to do: Apply Microsoft's April 2019 (or later) Windows security updates to all affected Windows 7, 8.1, RT 8.1, Windows 10 1507–1809, and Windows Server 2008/1709/1803 systems, per CISA's required action. Prioritize user-facing and shared systems (workstations, RDS/terminal servers, jump hosts) where an attacker is most likely to gain a local foothold, and verify patch levels through your update-management tooling.