Published: 16/05/2019 Updated: 24/05/2019
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 725
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

A vulnerability in the Windows Error Reporting (WER) component of Microsoft Windows could allow a local malicious user to execute arbitrary code on a targeted system. The vulnerability exists because the affected software improperly handles files. An attacker could exploit the vulnerability by accessing the system and executing an application that submits malicious input to the affected software. A successful exploit could allow the malicious user to execute arbitrary code with Administrator privileges and completely compromise the system. Microsoft confirmed the vulnerability and released software updates.

Vulnerability Trend


EDIT: Apparently this was patched earlier this month so whatever Windows Error Reporting Arbitrary DACL write It can take upwards of 15 minutes for the bug to trigger If it takes too long, closing the program, cleaning out the reportarchive folder in programdata (it may mess up the timing if there's too many reports in there as result of runn ...

Github Repositories

Watson Watson is a NET tool designed to enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities My focus is on the latest priv esc's for the mainstream Operating Systems, to help pentesters leverage that timeframe between Patch Tuesday and patch deployment Supported Versions Windows 10 1703, 1709, 1803 & 1809 Server 2016 &

Recent Articles

Microsoft Patch Tuesday – May 2019
Symantec Threat Intelligence Blog • Ratheesh PM • 15 May 2020

This month the vendor has patched 79 vulnerabilities, 22 of which are rated Critical.

Posted: 15 May, 201924 Min ReadThreat Intelligence SubscribeFollowtwitterfacebooklinkedinMicrosoft Patch Tuesday – May 2019This month the vendor has patched 79 vulnerabilities, 22 of which are rated Critical.As always, customers are advised to follow these security best practices:

Install vendor patches as soon as they are available.
Run all software with the least privileges required while still maintai...

IT threat evolution Q2 2019. Statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Boris Larin Oleg Kupreev Evgeny Lopatin • 19 Aug 2019

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
According to Kaspersky Security Network,
Q2 2019 will be remembered for several events.
First, we uncovered a large-scale financial threat by the name of Riltok, which targeted clients of not only major Russian banks, but some foreign ones too.
Second, we detected the new Trojan.AndroidOS.MobOk malware, tasked with stealing money from mobil...

SandboxEscaper Debuts ByeBear Windows Patch Bypass
Threatpost • Lindsey O'Donnell • 07 Jun 2019

Guerrilla developer SandboxEscaper has disclosed a second bypass exploit for a patch that fixes a Windows local privilege-escalation (LPE) flaw — again without notifying Microsoft.
The exploit, dubbed “ByeBear,” enables attackers to get past the patch to attack a permissions-overwrite, privilege-escalation flaw (CVE-2019-0841), which exists because Windows AppX Deployment Service (AppXSVC) improperly handles hard links. It allows a local attacker to run processes in an elevated conte...

SandboxEscaper Drops Three More Windows Exploits, IE Zero-Day
Threatpost • Lindsey O'Donnell • 23 May 2019

On the heels of releasing a Windows zero-day exploit on Wednesday, developer SandboxEscaper has dropped exploit code for four more flaws on Thursday morning.
On Wednesday, she dropped a Windows zero-day exploit that would allow local privilege-escalation (LPE), by importing legacy tasks from other systems into the Task Scheduler utility – and she promised four more unpatched bugs while she was at it.
SandboxEscaper held true to that promise, on Thursday releasing on GitHub the proo...

PoC Exploits Released for Two More Windows Vulnerabilities
BleepingComputer • Lawrence Abrams • 23 May 2019

Right on the heels of a privilege escalation zero-day vulnerability for Windows 10 released yesterday, the same researcher has released exploit code for two more vulnerabilities today.
A security researcher named SandboxEscaper is known for dropping zero-day vulnerabilities and exploits for Microsoft. Just yesterday, the researcher released a local privilege escalation vulnerability that utilizes the Windows 10 Task Scheduler. When used, the vulnerability allows users gain permissions to...

Microsoft emits free remote-desktop security patches for WinXP to Server 2008 to avoid another WannaCry
The Register • Iain Thomson in San Francisco • 15 May 2019

Plus plenty of other fixes from Redmond and Adobe – and special guest star Citrix

Patch Tuesday It’s that time of the month again, and Microsoft has released a bumper bundle of security fixes for Patch Tuesday, including one for out-of-support operating systems Windows XP and Server 2003.
Usually support for such aging operating systems costs an arm and a leg, though Redmond has released a freebie because of the serious nature of the critical flaw, assigned CVE-2019-0708, in Remote Desktop Services, or Terminal Services as it was. The vulnerability allows remote code ...

Microsoft Patches Zero-Day Bug Under Active Attack
Threatpost • Tom Spring • 14 May 2019

Microsoft has released a patch for an elevation-of-privileges vulnerability rated important, which is being exploited in the wild.
The bug fix is part of Microsoft’s May Patch Tuesday Security Bulletin. It’s tied to the Windows Error Reporting feature and is being abused by attackers who have gained local access to affected PCs. They are able to trigger arbitrary code-execution in kernel mode — resulting in a complete system compromise.
“They would need to first gain access t...

Microsoft's May 2019 Patch Tuesday Fixes 79 Vulnerabilities
BleepingComputer • Lawrence Abrams • 14 May 2019

Today is Microsoft's May 2019 Patch Tuesday, which means Windows admins are pouring themselves a drink (maybe two) and getting ready ti pull their hair out while testing the new patches and security updates released by Microsoft. Included in this month's updates are fixes for publicly disclosed or exploited vulnerabilities.
With the release of the May 2019 security updates, Microsoft has released 3 advisories and updates for 79 vulnerabilities, with 19 being classified as Critical. T...