CVE-2019-0880: Microsoft Windows splwow64.exe local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a high-severity local privilege escalation listed in CISA KEV, so it is actively exploited and should be patched promptly, though it requires prior local access.

What it is

splwow64.exe, the Windows print driver host process, mishandles certain calls, allowing a local user to elevate privileges. The flaw affects a broad set of Windows client and server releases, and Microsoft addressed it with a security update. Because it is a local elevation of privilege, it matters most as a post-compromise step to gain SYSTEM-level rights.

Impact

An attacker who already has code execution as a low-privileged user can escalate to higher privileges, potentially SYSTEM, on the affected host. That enables full control of the machine, including credential access and disabling of defenses.

Attack surface

The attack is local, requiring the attacker to run code on the target system; the CVSS vector shows low privileges required and no user interaction. It is not remotely reachable and no authentication beyond an existing local session is needed.

Exploitation

CVE-2019-0880 is listed in CISA's Known Exploited Vulnerabilities catalog, indicating exploitation in the wild, though no ransomware campaign use is recorded. EPSS gives a 30-day probability of about 2.3 percent (82nd percentile).

What to do

• Apply the Microsoft security update for CVE-2019-0880 to all affected Windows client and server versions.
• Prioritize patching on systems where untrusted users or processes can execute code locally.
• Restrict local logon and code execution rights to reduce the pool of accounts that can trigger the flaw.
• Monitor and limit use of splwow64.exe where printing is not required.
• Track remediation against the CISA KEV due date for this CVE.

Detection

• Alert on splwow64.exe spawning unexpected child processes or loading unusual modules.
• Monitor for privilege escalation from medium-integrity to SYSTEM-level tokens on endpoints.
• Review process creation events involving splwow64.exe outside normal print operations.
• Correlate local exploit activity with subsequent credential dumping or defense evasion behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.