CVE-2019-18619

Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers.

• CWE-763

• https://support.hp.com/hk-en/document/c06696568Patch, Third Party Advisory
• https://support.lenovo.com/us/en/product_security/LEN-31372Patch, Third Party Advisory
• https://www.synaptics.com/company/blog/Vendor Advisory
• https://www.synaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdfVendor Advisory
• https://www.syssec.wiwi.uni-due.de/en/research/research-projects/analysis-of-tee-software/Vendor Advisory
• https://support.hp.com/hk-en/document/c06696568Patch, Third Party Advisory
• https://support.lenovo.com/us/en/product_security/LEN-31372Patch, Third Party Advisory
• https://www.synaptics.com/company/blog/Vendor Advisory
• https://www.synaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdfVendor Advisory
• https://www.syssec.wiwi.uni-due.de/en/research/research-projects/analysis-of-tee-software/Vendor Advisory

Published

Jul 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18610An issue was discovered in manager.c in Sangoma Asterisk thr…8.8
• CVE-2019-18611An issue was discovered in the CheckUser extension through 1…6.5
• CVE-2019-18612An issue was discovered in the AbuseFilter extension through…5.3
• CVE-2019-18614On the Cypress CYW20735 evaluation board, any data that exce…7.8
• CVE-2019-18615In CloudVision Portal (CVP) for all releases in the 2018.2 T…4.9
• CVE-2019-18618Incorrect access control in the firmware of Synaptics VFS75x…6
• CVE-2019-1862A vulnerability in the web-based user interface (Web UI) of …7.2
• CVE-2019-18622An issue was discovered in phpMyAdmin before 4.9.2. A crafte…9.8
• CVE-2019-18623Escalation of privileges in EnergyCAP 7 through 7.5.6 allows…9.8
• CVE-2019-18624Opera Mini for Android allows attackers to bypass intended r…9.8
• CVE-2019-18625An issue was discovered in Suricata 5.0.0. It was possible t…7.5
• CVE-2019-18626Harris Ormed Self Service before 2019.1.4 allows an authenti…4.3