Main Vulnerability Database Vulnerabilities #VU21033

Information disclosure in Microsoft Windows and Windows Server - CVE-2019-1280

Published: September 11, 2019

Vulnerability identifier: #VU21033

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1280

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing .LNK files. A remote attacker can trick the victim to open a network location or a USB drive with specially crafted LNK file present in it and execute arbitrary code on the system with privileges of the current user.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2019-1280

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1280

Related Security Bulletins