CVE-2019-0796

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

Published: Apr 9, 2019
Updated: Apr 13, 2023
CVE: CVE-2019-0796
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.5
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

Severity: Low
Score: 2.1
AV:L/AC:L/Au:N/C:N/I:P/A:N

CWEs:

CWE-264

Affected Software
References

Software	From	Fixed in
microsoft / windows_server_2008	r2-sp1	r2-sp1.x
microsoft / windows_server_2012	r2	r2.x
microsoft / windows_10	1607	1607.x
microsoft / windows_server_2008	--sp2	--sp2.x
microsoft / windows_7	--sp1	--sp1.x
microsoft / windows_10	1703	1703.x
microsoft / windows_10	1709	1709.x
microsoft / windows_server_2016	1709	1709.x
microsoft / windows_10	1803	1803.x
microsoft / windows_server_2016	1803	1803.x
microsoft / windows_10	1809	1809.x

http://packetstormsecurity.com/files/152535/Microsoft-Windows-LUAFV-LuafvCopyShortName-Arbitrary-Short-Name-Privilege-Escalation.html
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0796
https://www.exploit-db.com/exploits/46715/

Vulnerability Database

289,571

CVE-2019-0796