CVE-2019-1458: Microsoft Windows vulnerability

1. In CISA KEVCISA KEV catalogue10 Jan 2022
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not established: not seen

DescriptionCVE.org

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

• Microsoft · Windows10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 7 for 32-bit Systems Service Pack 1; 7 for x64-based Systems Service Pack 1 and 3 more
• Microsoft · Windows Server2016; 2016 (Core installation); 2008 for 32-bit Systems Service Pack 2; 2008 for 32-bit Systems Service Pack 2 (Core installation); 2008 for Itanium-Based Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2 and 8 more

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.

CISA KEV

Listed since 10 Jan 2022 · known ransomware use · catalogue entry

Public check

No public nuclei template

Vendor

Microsoft

Published

December 2019

Band

Exploited in the wild, December 2019

1. 5 Nov
   CISA’s KEV entry now notes known ransomware use CISA
2. 10 Jan 2022
   CISA added it to the KEV catalogue CISA

• NVD entrynvd.nist.gov
• CISA KEV cataloguecisa.gov
• CVE recordcve.org
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2portal.msrc.microsoft.com
• packetstormsecurity.com/files/156651/Microsoft-Windows-WizardOpipacketstormsecurity.com
• packetstormsecurity.com/files/159569/Microsoft-Windows-Uninitialpacketstormsecurity.com