CVE-2019-0836

HIGH

Windows - Elevation of Privilege via LUAFV Driver Race Condition

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-0836. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit leverages a race condition in the LUAFV driver's LuafvPostReadWrite callback to overwrite SECTION_OBJECT_POINTERS, allowing elevation of privilege by mapping a delay-virtualized file as read-write. The PoC demonstrates this by mapping license.rtf writable, enabling modification of the original file.

Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0841.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textlocalwindows

https://www.exploit-db.com/exploits/46718

View Code ZIP pw:eip

The exploit leverages a race condition in the LUAFV driver's LuafvPostReadWrite callback to overwrite SECTION_OBJECT_POINTERS, allowing elevation of privilege by mapping a delay-virtualized file as read-write. The PoC demonstrates this by mapping license.rtf writable, enabling modification of the original file.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: Windows 10 1809 (LUAFV driver)

Auth required

Prerequisites: Access to a delay-virtualized file · Ability to trigger oplock breaks

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0836

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/107719

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/46718/

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/152538/Microsoft-Windows-LUAFV-PostLuafvPostReadWrite-SECTION_OBJECT_POINTERS-Race-Condition.html

Scores

CVSS v3 7.8

EPSS 0.0414

EPSS Percentile 89.5%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-367

Status published

Products (17)

microsoft/windows_10

microsoft/windows_10 1607

microsoft/windows_10 1703

microsoft/windows_10 1709

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

... and 7 more

Published Apr 09, 2019

Tracked Since Feb 18, 2026