CVE-2019-0808
High 7.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Microsoft Win32k Privilege Escalation Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.
Metrics
- CVSS 3.1
-
7.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 53% (percentile: 99) as of 2 November 2026
Affected products
microsoft: windows 7; microsoft: windows server 2008
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0808 PatchVendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0808 PatchVendor Advisory
- http://packetstormsecurity.com/files/157616/Microsoft-Windows-NtUserMNDragOver-… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/157616/Microsoft-Windows-NtUserMNDragOver-… ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019… US Government Resource