CVE-2019-0796

MEDIUM

Windows - Privilege Escalation via LUAFV Driver Improper Call Handling

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-0796. PoCs published by Google Security Research.

AI-analyzed exploit summary The writeup details a privilege escalation vulnerability in the LUAFV driver on Windows 10 1809, where arbitrary short names can be written due to bypassed security checks during file virtualization. It includes a technical breakdown of the exploit mechanism and a reference to a Proof of Concept (PoC) in C#.

Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Google Security Research · textlocalwindows

https://www.exploit-db.com/exploits/46715

View Code ZIP pw:eip

The writeup details a privilege escalation vulnerability in the LUAFV driver on Windows 10 1809, where arbitrary short names can be written due to bypassed security checks during file virtualization. It includes a technical breakdown of the exploit mechanism and a reference to a Proof of Concept (PoC) in C#.

Classification

Writeup 90%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Windows 10 1809 (LUAFV driver)

Auth required

Prerequisites: Access to a virtualized directory (e.g., ProgramData) · Ability to create files with specific permissions

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0796

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/46715/

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/152535/Microsoft-Windows-LUAFV-LuafvCopyShortName-Arbitrary-Short-Name-Privilege-Escalation.html

Scores

CVSS v3 5.5

EPSS 0.0424

EPSS Percentile 89.7%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-264

Status published

Products (17)

microsoft/windows_10

microsoft/windows_10 1607

microsoft/windows_10 1703

microsoft/windows_10 1709

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

... and 7 more

Published Apr 09, 2019

Tracked Since Feb 18, 2026