CVE-2019-1409

—

CVSS 3.1

5.5 medium

EPSS

1%p71

Published

Nov 12, 2019 (Nov 12, 2019)

Modified

Jun 17, 2026

Description

An information disclosure vulnerability exists when the Windows Remote Procedure Call (RPC) runtime improperly initializes objects in memory, aka 'Windows Remote Procedure Call Information Disclosure Vulnerability'.

Vendors: microsoft
Products: windows 10, windows 7, windows 8.1, windows rt 8.1, windows server 2008, windows server 2012, windows server 2016, windows server 2019
Weakness: CWE-665
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news3 stories

January 2021 Patch Tuesday: Microsoft plugs Defender zero-day RCE

Help Net SecurityNov 14, 08:33 UTC · Nov 14, 2023Exploit / PoC in the wildCVE-2021-1647 CVE-2021-1648 CVE-2021-1658+8 CVEs

Microsoft Patch Tuesday, January 2021 Edition

Krebs on SecurityJan 15, 00:00 UTC · Jan 15, 2021Vulnerability in the wildCVE-2021-1647 CVE-2020-1660 CVE-2019-1409+4 CVEs

Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage

Cisco TalosNov 12, 19:58 UTC · Nov 12, 2019Vulnerability CVE-2019-1448 CVE-2019-0721 CVE-2019-1389+70 CVEs