CVE-2019-0803: Microsoft Windows Win32k memory handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8, CISA KEV listing with known ransomware use, and high EPSS probability make this a high-priority local privilege escalation flaw.

What it is

The Win32k component in Windows fails to properly handle objects in memory, allowing an elevation of privilege. A local attacker who can run code on a host can exploit this to gain higher privileges, which matters because it is a known exploited vulnerability used in ransomware campaigns.

Impact

An attacker gains elevated privileges on the affected Windows system, enabling full control of the host from a low-privileged starting point.

Attack surface

The vulnerability is local (CVSS vector AV:L) and requires low privileges (PR:L) with no user interaction (UI:N). It is reached by running crafted code on the target machine, not over the network.

Exploitation

CVE-2019-0803 is listed in CISA KEV with known ransomware campaign use, and EPSS shows a 30-day probability of 0.4523 (98.7th percentile), indicating active exploitation.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for CVE-2019-0803.
• Prioritize patching internet-facing and high-value Windows systems, including Windows 7, 8.1, 10, and Server 2008 through 2019.
• Restrict local interactive and code execution privileges to reduce the attack surface for local privilege escalation.
• Monitor for and block known ransomware tooling and post-exploitation behavior on unpatched hosts.

Detection

• Monitor for unexpected privilege escalation events and suspicious process token changes on Windows endpoints.
• Alert on execution of known exploit code or tooling associated with Win32k privilege escalation.
• Correlate local process creation with subsequent high-integrity actions on hosts missing the patch.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.