CVE-2019-1148

An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The update addresses the vulnerability by correcting the way in which the Windows Graphics Component handles objects in memory.

• CWE-125
• CWE-125

• http://packetstormsecurity.com/files/154084/Microsoft-Font-Subsetting-DLL-GetGlyphId-Out-Of-Bounds-Read.htmlThird Party Advisory, VDB Entry
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1148Patch, Vendor Advisory
• http://packetstormsecurity.com/files/154084/Microsoft-Font-Subsetting-DLL-GetGlyphId-Out-Of-Bounds-Read.htmlThird Party Advisory, VDB Entry
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1148Patch, Vendor Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11473coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to ca…
• CVE-2019-11474coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to ca…6.5
• CVE-2019-11476An integer overflow in whoopsie before versions 0.2.52.5ubun…6.5
• CVE-2019-11477Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso…7.5
• CVE-2019-11478Jonathan Looney discovered that the TCP retransmission queue…5.3
• CVE-2019-11479Jonathan Looney discovered that the Linux kernel default MSS…7.5
• CVE-2019-11480The pc-kernel snap build process hardcoded the --allow-insec…8.1
• CVE-2019-11481Kevin Backhouse discovered that apport would read a user-sup…7.8
• CVE-2019-11482Sander Bos discovered a time of check to time of use (TOCTTO…4.7
• CVE-2019-11483Sander Bos discovered Apport mishandled crash dumps originat…3.3
• CVE-2019-11484Kevin Backhouse discovered an integer overflow in bson_ensur…7.8
• CVE-2019-11485Sander Bos discovered Apport's lock file was in a world-writ…3.3