CVE-2019-1039
Last modified
CVE-2019-1039 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory.. EPSS estimates a 1.35% chance of exploitation in the next 30 days.
Description
An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Windows 10 | All versions | — |
| Microsoft | Windows 10 | 1607 | — |
| Microsoft | Windows 10 | 1703 | — |
| Microsoft | Windows 10 | 1709 | — |
| Microsoft | Windows 10 | 1803 | — |
| Microsoft | Windows 10 | 1809 | — |
| Microsoft | Windows 10 | 1903 | — |
| Microsoft | Windows 7 | All versions | Sp1 |
| Microsoft | Windows 8.1 | All versions | — |
| Microsoft | Windows Rt 8.1 | All versions | — |
| Microsoft | Windows Server 2008 | All versions | Sp2 |
| Microsoft | Windows Server 2008 | r2 | Sp1 |
| Microsoft | Windows Server 2012 | All versions | — |
| Microsoft | Windows Server 2012 | r2 | — |
| Microsoft | Windows Server 2016 | All versions | — |
| Microsoft | Windows Server 2016 | 1803 | — |
| Microsoft | Windows Server 2016 | 1903 | — |
| Microsoft | Windows Server 2019 | All versions | — |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1039?
How severe is CVE-2019-1039?
How do I fix CVE-2019-1039?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10384Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed u…8.8
- CVE-2019-10385Jenkins eggPlant Plugin 2.2 and earlier stores credentials u…6.5
- CVE-2019-10386A cross-site request forgery vulnerability in Jenkins XL Tes…8.8
- CVE-2019-10387A missing permission check in Jenkins XL TestView Plugin 1.2…6.5
- CVE-2019-10388A cross-site request forgery vulnerability in Jenkins Reluti…4.3
- CVE-2019-10389A missing permission check in Jenkins Relution Enterprise Ap…4.3
- CVE-2019-10390A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.…8.8
- CVE-2019-10391Jenkins IBM Application Security on Cloud Plugin 1.2.4 and e…6.5
- CVE-2019-10392Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did…8.8
- CVE-2019-10393A sandbox bypass vulnerability in Jenkins Script Security Pl…4.2
- CVE-2019-10394A sandbox bypass vulnerability in Jenkins Script Security Pl…4.2
- CVE-2019-10395Jenkins Build Environment Plugin 1.6 and earlier did not esc…5.4
Are you affected by CVE-2019-1039?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST