CVE-2019-0730

HIGH

Windows - Privilege Escalation via LUAFV Driver Improper Call Handling

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-0730. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit leverages a vulnerability in the LUAFV driver where the DesiredAccess parameter, including MAXIMUM_ACCESS, is reused when virtualizing a file, leading to an Elevation of Privilege (EoP). The PoC demonstrates how a normal user can overwrite a file they shouldn't have access to by manipulating file virtualization and hardlinks.

Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textlocalwindows

https://www.exploit-db.com/exploits/46713

View Code ZIP pw:eip

The exploit leverages a vulnerability in the LUAFV driver where the DesiredAccess parameter, including MAXIMUM_ACCESS, is reused when virtualizing a file, leading to an Elevation of Privilege (EoP). The PoC demonstrates how a normal user can overwrite a file they shouldn't have access to by manipulating file virtualization and hardlinks.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Windows 10 1809 (LUAFV driver)

Auth required

Prerequisites: Normal user access · File virtualization enabled · Target file on the same drive as the virtual store

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1134 - Access Token Manipulation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0730

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/46713/

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/152533/Microsoft-Windows-LUAFV-Delayed-Virtualization-MAXIMUM_ACCESS-DesiredAccess-Privilege-Escalation.html

Scores

CVSS v3 7.8

EPSS 0.0435

EPSS Percentile 90.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-264

Status published

Products (17)

microsoft/windows_10

microsoft/windows_10 1607

microsoft/windows_10 1703

microsoft/windows_10 1709

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

... and 7 more

Published Apr 09, 2019

Tracked Since Feb 18, 2026