CVE-2019-1089

HIGH

Windows RPCSS - Authenticated Privilege Escalation via Improper RPC Request Handling

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-1089. PoCs published by Google Security Research.

AI-analyzed exploit summary The exploit leverages a flaw in the RPCSS Activation Kernel RPC server's security callback caching mechanism, allowing a low-privileged user to bypass PID checks and access privileged operations, such as setting arbitrary SYSAPPID values for sandbox escape.

Description

An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request. To exploit this vulnerability, a low level authenticated attacker could run a specially crafted application. The security update addresses this vulnerability by correcting how rpcss.dll handles these requests., aka 'Windows RPCSS Elevation of Privilege Vulnerability'.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textlocalwindows

https://www.exploit-db.com/exploits/47135

View Code ZIP pw:eip

The exploit leverages a flaw in the RPCSS Activation Kernel RPC server's security callback caching mechanism, allowing a low-privileged user to bypass PID checks and access privileged operations, such as setting arbitrary SYSAPPID values for sandbox escape.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Windows 10 1903/1809 (RPCSS Activation Kernel)

Auth required

Prerequisites: User-level access on Windows 10 1903/1809 · Ability to spawn a COM server (e.g., calculator AC)

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1134 - Access Token Manipulation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1089

Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/153683/Microsoft-Windows-RPCSS-Activation-Kernel-Security-Callback-Privilege-Escalation.html

Scores

CVSS v3 7.8

EPSS 0.0491

EPSS Percentile 91.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published

Products (18)

microsoft/windows_10

microsoft/windows_10 1607

microsoft/windows_10 1703

microsoft/windows_10 1709

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_10 1903

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

... and 8 more

Published Jul 15, 2019

Tracked Since Feb 18, 2026