CVE-2019-0880

CVE-2019-0880 is a local elevation of privilege (EoP) flaw in how splwow64.exe — the 64-bit Windows process used to let 32-bit applications print — handles certain calls. An attacker who can already execute low-privileged code on an affected system can trigger the flaw with no user interaction and gain elevated privileges, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/PR:L/UI:N). The affected list covers most of the Windows fleet of the era: Windows 10 versions 1507 through 1903, Windows 8.1, Windows RT 8.1, and Windows Server 2012, 2016, and version 1903. Microsoft shipped the fix in the July 2019 security updates, which related coverage tied to two actively exploited Windows zero-days, and CISA formally added the flaw to its Known Exploited Vulnerabilities catalog on 2022-05-23, confirming in-the-wild exploitation (ransomware association unknown). EPSS currently rates the 30-day exploitation probability at 2.3% (82nd percentile), so unpatched systems remain a realistic target.

What to do: Apply the Microsoft security updates released in July 2019, or any later cumulative updates, to all affected Windows 10, Windows 8.1, Windows RT 8.1, and Windows Server systems, per the CISA KEV required action. Because exploitation requires local low-privileged code execution, prioritize shared and multi-user systems such as RDS/terminal servers, shared workstations, and kiosks. Verify remediation against the KEV entry added 2022-05-23; no public PoC is known, and no ransomware association has been established.