Microsoft Windows Win32k Kernel Memory Corruption Local Privilege Escalation (CVE-2019-0808)

1. Vulnerability Overview & Root Cause

An elevation of privilege vulnerability exists in the Windows kernel-mode driver win32k.sys due to improper handling of objects in memory. Specifically, a Use-After-Free (UAF) or Null pointer dereference condition occurs within the NtUserMNDragOver system call, which manages window messages and drag-and-drop menu operations. An attacker can exploit this by running a specially crafted local application to corrupt kernel memory structures.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first execute an unprivileged process on the target system. The exploit intercepts the window message loop during a drag-and-drop operation by creating specific window classes and menu objects. When NtUserMNDragOver is triggered, the kernel is forced to reference a freed menu object without proper validation. By spraying the kernel pool, the attacker controls the freed memory space, redirects execution flow to their payload, and performs token stealing to elevate privileges to NT AUTHORITY\SYSTEM.

3. Infrastructure & Business Impact

This vulnerability has been actively exploited in the wild and is cataloged in CISA's Known Exploited Vulnerabilities (KEV). With an EPSS score exceeding 0.53, the likelihood of exploitation is extremely high. Successful exploitation allows an attacker who has established a foothold in the network to compromise domain controllers or critical servers, leading to full domain takeover, ransomware deployment, and persistent backdoor installation.