CVE-2019-0803

What is Win32k?

Win32k.sys is the kernel-mode driver underpinning the Windows GUI subsystem — window management, drawing, and input handling — on every desktop Windows release. Because it executes in kernel mode while directly processing requests from ordinary user-mode applications, it is one of the most consistently targeted components for local privilege escalation, letting an attacker jump from a limited user context straight to kernel-level control.

Overview

CVE-2019-0803 is a High-severity privilege escalation vulnerability in Win32k caused by improper handling of objects in memory. A locally authenticated attacker running a specially crafted application could use the flaw to execute code in kernel mode, gaining full control of the affected system. Microsoft fixed it as part of the April 2019 Patch Tuesday update.

Technical Details

The vulnerability is a kernel memory-corruption issue reachable through Win32k's system call interface, which any user-mode process can invoke. Exploitation requires local access and low privileges but no user interaction, and grants full confidentiality, integrity, and availability impact through kernel-mode code execution. As with other Win32k EoP bugs of this era, this is a "second stage" bug: an attacker first needs some form of initial code execution (via a browser, document, or email exploit, or a compromised low-privilege account) before using this flaw to elevate to SYSTEM.

Discovery

Fixed through Microsoft's routine internal security review as part of April 2019 Patch Tuesday; no external researcher has been broadly credited for this specific finding.

Exploitation Context

CISA's KEV catalog entry confirms this vulnerability has been exploited in the wild. Consistent with the broader pattern of Win32k privilege-escalation bugs from this period, it is most plausibly used as the elevation stage of a multi-exploit chain following an initial low-privilege compromise, rather than as a standalone remote attack.

Remediation

1. Apply the April 2019 Patch Tuesday cumulative update (or any later update) for the affected Windows version.
2. Prioritize patching on endpoints with general user browsing and email access, since local EoP bugs are typically chained with an initial-access exploit.
3. Enable kernel exploit mitigations (Kernel DEP, Control Flow Guard, HVCI where supported).
4. Deploy endpoint detection capable of flagging anomalous privilege transitions or unexpected kernel-mode activity.
5. Apply application allowlisting to reduce the ability of arbitrary user-supplied code to run in the first place.