NULL pointer dereference in Microsoft Windows and Windows Server - CVE-2019-1132
Published: July 9, 2019 / Updated: November 20, 2020
Vulnerability identifier: #VU19062
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1132
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a NULL pointer dereference error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.
Note, this vulnerability is being actively exploited in the wild.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2019-1132
Install update from vendor's website.