CVE-2019-1057

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the user’s system. To exploit the vulnerability, an attacker could host a specially crafted website designed to invoke MSXML through a web browser. However, an attacker would have no way to force a user to visit such a website. Instead, an attacker would typically have to convince a user to either click a link in an email message or instant message that would then take the user to the website. When Internet Explorer parses the XML content, an attacker could run malicious code remotely to take control of the user’s system. The update addresses the vulnerability by correcting how the MSXML parser processes user input.

• CWE-611
• CWE-94

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1057Patch, Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1057Patch, Vendor Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10564Possible OOB issue in EEPROM due to lack of check while acce…7.8
• CVE-2019-10565Double free issue can happen when sensor power settings is f…9.8
• CVE-2019-10566Buffer overflow can occur in wlan module if supported rates …7.8
• CVE-2019-10567There is a way to deceive the GPU kernel driver into thinkin…7.8
• CVE-2019-10568Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-10569Stack buffer overflow due to instance id is misplaced inside…7.8
• CVE-2019-10571Snapshot of IB can lead to invalid address access due to mis…7.8
• CVE-2019-10572Improper check in video driver while processing data from vi…9.8
• CVE-2019-10573Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-10574Lack of boundary checks for data offsets received from HLOS …7.1
• CVE-2019-10575Wlan binary which is not signed with OEMs RoT is working on …7.8
• CVE-2019-10577Improper input validation while processing SIP URI received …9.1