CVE-2019-0735

HIGH

Windows Client Server Run-Time Subsystem - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-0735. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit leverages a weak key in the CSRSS SxS manifest cache to achieve privilege escalation by hijacking the cache entry for a system binary, allowing an attacker to load an arbitrary DLL into a privileged process.

Description

An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory, aka 'Windows CSRSS Elevation of Privilege Vulnerability'.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textlocalwindows

https://www.exploit-db.com/exploits/46712

View Code ZIP pw:eip

The exploit leverages a weak key in the CSRSS SxS manifest cache to achieve privilege escalation by hijacking the cache entry for a system binary, allowing an attacker to load an arbitrary DLL into a privileged process.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Windows 10 1809, 1709

Auth required

Prerequisites: Access to a normal user account · Ability to redirect the system drive during process creation · A target executable with an embedded manifest that runs in session 0 as a privileged user

MITRE ATT&CK

T1548.002 - Bypass User Account Control T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0735

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/46712/

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/152532/Microsoft-Windows-CSRSS-SxSSrv-Cached-Manifest-Privilege-Escalation.html

Scores

CVSS v3 7.8

EPSS 0.0366

EPSS Percentile 88.2%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-269

Status published

Products (17)

microsoft/windows_10

microsoft/windows_10 1607

microsoft/windows_10 1703

microsoft/windows_10 1709

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

... and 7 more

Published Apr 09, 2019

Tracked Since Feb 18, 2026