CVE-2019-0731

HIGH

Windows - Privilege Escalation via LUAFV Driver Handle Duplication

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-0731. PoCs published by Google Security Research.

AI-analyzed exploit summary The writeup details a privilege escalation vulnerability in the LUAFV driver on Windows 10 1809, where delayed virtualization fails to account for handle duplication to higher-privileged processes, allowing arbitrary file creation in privileged locations. The technical analysis includes root cause, exploitation methods, and mitigation suggestions.

Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Google Security Research · textlocalwindows

https://www.exploit-db.com/exploits/46714

View Code ZIP pw:eip

The writeup details a privilege escalation vulnerability in the LUAFV driver on Windows 10 1809, where delayed virtualization fails to account for handle duplication to higher-privileged processes, allowing arbitrary file creation in privileged locations. The technical analysis includes root cause, exploitation methods, and mitigation suggestions.

Classification

Writeup 90%

Attack Type

Lpe

Complexity

Moderate

Reliability

Theoretical

Target: Windows 10 1809 LUAFV driver

Auth required

Prerequisites: User-level access to create virtualized files · Handle duplication to a higher-privileged process

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0731

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/46714/

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/152534/Microsoft-Windows-LUAFV-Delayed-Virtualization-Cross-Process-Handle-Duplication-Privilege-Escalation.html

Scores

CVSS v3 7.8

EPSS 0.0435

EPSS Percentile 90.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-264

Status published

Products (17)

microsoft/windows_10

microsoft/windows_10 1607

microsoft/windows_10 1703

microsoft/windows_10 1709

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

... and 7 more

Published Apr 09, 2019

Tracked Since Feb 18, 2026