CVE-2019-0805

HIGH

Windows - Elevation of Privilege via LUAFV Driver Calls

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-0805. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit demonstrates a cache poisoning vulnerability in the LUAFV driver on Windows 10 1809, allowing a user to replace the cached contents of a privileged file (e.g., license.rtf) with arbitrary data, leading to local privilege escalation. The PoC leverages delayed virtualization and section object manipulation to achieve this effect.

Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0836, CVE-2019-0841.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textlocalwindows

https://www.exploit-db.com/exploits/46717

View Code ZIP pw:eip

The exploit demonstrates a cache poisoning vulnerability in the LUAFV driver on Windows 10 1809, allowing a user to replace the cached contents of a privileged file (e.g., license.rtf) with arbitrary data, leading to local privilege escalation. The PoC leverages delayed virtualization and section object manipulation to achieve this effect.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Windows 10 1809

Auth required

Prerequisites: User-level access on Windows 10 1809 · A writable file in a virtualized directory (e.g., system32)

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0805

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/46717/

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/152537/Microsoft-Windows-LUAFV-Delayed-Virtualization-Cache-Manager-Poisoning-Privilege-Escalation.html

Scores

CVSS v3 7.8

EPSS 0.0278

EPSS Percentile 84.5%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-345

Status published

Products (17)

microsoft/windows_10

microsoft/windows_10 1607

microsoft/windows_10 1703

microsoft/windows_10 1709

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

... and 7 more

Published Apr 09, 2019

Tracked Since Feb 18, 2026