Exploitation Summary
CVE-2019-1458 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 10, 2022, with confirmed use in ransomware campaigns.
EIP tracks 5 public exploits from researchers including piotrflorczyk, rip1s, piotrflorczyk, unamer, timwr, including a Metasploit module exploits/windows/local/cve_2019_1458_wizardopium.
AI-analyzed exploit summary This exploit leverages a window message handling vulnerability in Windows to achieve local privilege escalation by manipulating window class registration and triggering a dereference of controlled memory via NtUserMessageCall.
Description
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
Exploits (5)
This exploit leverages a window message handling vulnerability in Windows to achieve local privilege escalation by manipulating window class registration and triggering a dereference of controlled memory via NtUserMessageCall.
This repository provides a detailed technical analysis and proof-of-concept development process for CVE-2019-1458, a Windows win32k.sys vulnerability. It includes patch diffing, root cause analysis, and step-by-step exploitation insights.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2019-1458, targeting Windows kernel vulnerabilities via NtUserMessageCall and NtUserDefSetText syscalls. The exploit manipulates window class structures to achieve arbitrary read/write in kernel memory, ultimately escalating privileges.
This Metasploit module exploits CVE-2019-1458, a local privilege escalation vulnerability in Windows win32k.sys due to an uninitialized variable, allowing controlled writes to kernel memory. It targets Windows 7 x64 SP1 and other vulnerable versions, executing a reflective DLL payload to elevate privileges to SYSTEM.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H