CVE-2019-1388

What is the Windows Certificate Dialog?

When a user attempts to run an unsigned or untrusted executable that requests administrative rights, Windows User Account Control (UAC) displays a consent dialog. That dialog includes an option to inspect the file's digital certificate. Because this certificate-viewing dialog is launched by a process running with elevated privileges (to support the UAC consent flow), any weakness in how it handles user-supplied input or spawns child processes can be abused to escalate privileges.

Overview

CVE-2019-1388 is a privilege escalation vulnerability in the way the Windows Certificate Dialog handles the certificate-viewing workflow launched from a UAC elevation prompt. When a user with administrative rights is shown the UAC consent prompt for an untrusted, signed-but-not-trusted executable and opens the certificate details/"Issuer Statement" link, the resulting help/viewer window runs in the elevated context established for the consent dialog. A local attacker can abuse this to spawn an arbitrary process with elevated privileges, effectively bypassing UAC. Microsoft rated this Important, CVSS 3.1 base score 7.8.

Technical Details

Classified under CWE-269 (Improper Privilege Management), the flaw exists because the certificate dialog's "more information" link opens a browser or help window without dropping the elevated token context inherited from the UAC prompt process. An attacker who can get an administrator to click through the consent-prompt certificate details (for example, via a malicious but signed installer, or a social-engineering pretext to "verify the publisher") can pivot from that elevated child window into launching arbitrary elevated code — achieving privilege escalation without needing to guess a password or exploit a separate memory-corruption bug.

Discovery

Microsoft credits the discovery to external researchers reporting through its coordinated disclosure program; the fix shipped in the November 2019 Patch Tuesday cumulative updates.

Exploitation Context

CISA added this CVE to the KEV catalog in April 2023 and flags it as used in ransomware operations. Because it requires an administrator to interact with a UAC prompt, it is typically chained with social engineering or a separate initial-access vector rather than used standalone — attackers who already have a foothold and a way to prompt or trick a privileged user into the certificate-dialog flow can leverage it for full local privilege escalation.

Remediation

1. Install the November 2019 Windows cumulative security update (or any later monthly rollup), which resolves CVE-2019-1388.
2. Confirm patch compliance through Windows Update reporting or a vulnerability management platform.
3. Train administrators to be cautious with "verify publisher" prompts on unexpected or unsigned-looking installers, and to avoid running installers from untrusted sources even when a UAC prompt appears.
4. Apply least-privilege practices so day-to-day accounts are not local administrators, reducing the population of users who could trigger the elevated dialog.
5. Monitor endpoint logs for unexpected elevated child processes spawned from certificate-viewer or UAC-related components.