CVE-2019-0880

What is splwow64.exe?

splwow64.exe is a Windows helper process that bridges 32-bit printing calls from applications to the 64-bit print spooler subsystem. Windows uses "integrity levels" (low, medium, high, system) as a sandboxing mechanism — processes running in a browser sandbox or other constrained context typically run at low integrity, which restricts what they can touch on the filesystem and registry. A component that improperly elevates a caller from low to medium integrity effectively breaks that sandboxing boundary.

Overview

CVE-2019-0880 is a High-severity local privilege-escalation vulnerability in how splwow64.exe handles certain calls. An attacker running code in a low-integrity context — such as inside a browser sandbox — could exploit the flaw to elevate to medium integrity, escaping part of the sandbox's intended restrictions. Microsoft fixed the issue in the July 2019 Patch Tuesday update.

Technical Details

The vulnerability lies in splwow64's handling of interprocess calls related to print job processing, which fails to adequately restrict what a low-integrity caller can request, allowing it to have code executed at medium integrity instead. While a low-to-medium integrity jump is less severe than a jump straight to SYSTEM, it is a meaningful sandbox-escape primitive: many browser and application sandboxes rely on the low-integrity boundary as their primary containment, and medium integrity carries substantially more access to the user's files, registry, and running processes, often serving as a stepping stone toward a full local EoP chain.

Discovery

Fixed through Microsoft's routine internal security review as part of the July 2019 Patch Tuesday cycle; no external researcher has been broadly credited publicly for this specific finding.

Exploitation Context

CISA's KEV catalog confirms this vulnerability has been exploited in the wild. Sandbox-escape primitives like this are typically valuable to attackers as an intermediate step in a longer exploit chain — following an initial browser or document-based low-integrity code-execution exploit — to gain enough additional access to proceed toward full system compromise.

Remediation

1. Apply the July 2019 Patch Tuesday cumulative update (or any later update) for the affected Windows version.
2. Prioritize patching on endpoints with general browsing exposure, since sandbox-escape bugs are typically chained with a browser or document exploit.
3. Keep browsers and other sandboxed applications updated in parallel, since this flaw is most valuable to attackers as part of a multi-stage exploit chain.
4. Deploy endpoint detection tuned to flag unexpected integrity-level transitions in process activity.
5. Apply Attack Surface Reduction rules to limit the initial code-execution vectors that would make this bug reachable.