Main Vulnerability Database Vulnerabilities #VU20271

Input validation error in Microsoft Windows and Windows Server - CVE-2019-1188

Published: August 14, 2019

Vulnerability identifier: #VU20271

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1188

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input when processing .LNK files. A remote attacker can trick the victim to open a drive or remote share with malicious Windows shortcut file (.LNK) with Windows Explorer and execute arbitrary code on the system with privileges of the current user.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2019-1188

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1188

Related Security Bulletins