CVE-2019-0859: Microsoft Windows Win32k memory handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8 with local low-privilege access, CISA KEV listing and documented ransomware use make this a high-priority elevation of privilege flaw despite the local attack vector.

What it is

The Win32k component in Windows fails to properly handle objects in memory, creating an elevation of privilege flaw. A local attacker who can run code on a target can exploit this to gain higher privileges, which matters because it enables full system compromise from a low-privileged foothold.

Impact

An attacker gains elevated privileges on the affected host, with high impact to confidentiality, integrity and availability. In practice this allows a local user to take over the machine and is commonly chained with other bugs or used post-compromise.

Attack surface

Reached locally (AV:L) with low attack complexity and low privileges required (PR:L), and no user interaction (UI:N). No network vector is described; the attacker must already have some ability to execute code on the system.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is about 4.2 percent (90th percentile). The vendor references are patch and advisory only, so no public exploit details are given in this record.

What to do

• Apply the Microsoft security update for CVE-2019-0859 on all affected Windows versions, prioritizing internet-facing and high-value hosts.
• Treat KEV status and known ransomware use as urgent: verify patching across Windows 7, 8.1, RT 8.1, Windows 10 builds 1507 through 1809, and the listed server editions.
• Restrict local interactive and code-execution access to trusted users, since exploitation requires an existing low-privileged foothold.
• Monitor for and block known ransomware tooling and post-exploitation behavior that relies on local privilege escalation.
• Where legacy systems cannot be patched, isolate them and apply compensating controls such as application allowlisting.

Detection

• Monitor for unexpected privilege changes and suspicious token or process elevation on Windows endpoints.
• Alert on known Win32k exploitation patterns and unusual child processes spawned from low-privileged contexts.
• Correlate local privilege escalation attempts with ransomware precursor activity such as credential access and lateral movement.
• Audit patch state for the affected Windows builds and flag unpatched hosts for remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.