Microsoft Windows splwow64 Local Privilege Escalation Vulnerability (CVE-2019-0880) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTsplwow64.exe process running on 64-bit versions of Microsoft Windows operating systems
Local attackers with low privileges can execute arbitrary code with SYSTEM privileges, leading to full system compromise
Apply the official Microsoft security patches immediately, or disable the Print Spooler service on non-essential servers
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official cumulative security updates provided by Microsoft. Use the following PowerShell commands to force-install the required updates.
# Install Windows Update module and apply the latest security updates
Install-Module PSWindowsUpdate -Force -Confirm:$false
Get-WindowsUpdate -KBArticleID 'KB4507453', 'KB4507448' -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, disable the Print Spooler service on critical servers that do not require printing capabilities to mitigate the attack vector.
# Stop and disable the Print Spooler service to mitigate the vulnerability
Stop-Service -Name 'Spooler' -Force
Set-Service -Name 'Spooler' -StartupType Disabled3. Log Audit & IoC Verification Commands
Verify the file version of splwow64.exe and audit process creation logs to detect potential exploitation attempts.
# Check the file version of splwow64.exe to verify patch status
Get-ItemProperty -Path 'C:\Windows\splwow64.exe' | Select-Object -Property VersionInfo | Format-List
# Query Sysmon logs for anomalous child processes spawned by splwow64.exe
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=1} -ErrorAction SilentlyContinue |
Where-Object {$_.Message -like '*splwow64.exe*' -and ($_.Message -like '*cmd.exe*' -or $_.Message -like '*powershell.exe*')}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A local elevation of privilege vulnerability exists in how 'splwow64.exe' (Printer Driver Host for 32-bit Applications) handles specific Local Procedure Call (LPC) or LPC-like communication messages. Because splwow64.exe runs with elevated integrity to bridge 32-bit applications to the 64-bit spooler subsystem, it fails to properly validate input memory pointers and parameters sent from lower-integrity processes, leading to an arbitrary memory write condition.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must first gain local execution access with low privileges on the target system. The attacker then establishes a connection to the LPC port exposed by splwow64.exe and transmits a crafted message containing malicious memory addresses. Due to the lack of input sanitization, splwow64.exe processes the request, allowing the attacker to write arbitrary data into its high-privilege memory space. This enables the attacker to hijack the execution flow and spawn a shell or execute payloads under the SYSTEM context.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is cataloged in CISA's Known Exploited Vulnerabilities (KEV). Successful exploitation bypasses standard operating system boundaries and endpoint security controls (EDR/AV). In an enterprise environment, this allows threat actors to perform lateral movement, deploy ransomware, dump credentials, and compromise the entire Active Directory domain.
Official Vendor Advisories & References
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.
Frequently Asked SecOps Questions (CVE-2019-0880)
FAQQ1. How critical is CVE-2019-0880 and is it actively exploited in the wild?
CVE-2019-0880 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 2.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-0880?
Primary impacted vendors include microsoft across windows, splwow64.exe. Scope summary: 64-bit architectures of Microsoft Windows operating systems, including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019
Q3. What temporary mitigations or workarounds exist for CVE-2019-0880 before patching?
[Mitigation] Apply the official Microsoft security patches immediately, or disable the Print Spooler service on non-essential servers Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-0880
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Windows Shell Protection Mechanism Failure and Network Spoofing Vulnerability (CVE-2026-32202) Analysis and Mitigation Guide
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Shell component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.