Back
CVE-2019-1365
CRITICAL
An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\system escaping the Sandbox.The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests., aka 'Microsoft IIS Server Elevation of Privilege Vulnerability'.
Published: Oct 10, 2019
Modified: Jun 17, 2026
NVD-CWE-noinfo
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products (16)
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows_10 | 1607 |
| microsoft | windows_10 | 1803 |
| microsoft | windows_10 | 1809 |
| microsoft | windows_10 | 1903 |
| microsoft | windows_7 | - |
| microsoft | windows_8.1 | - |
| microsoft | windows_rt_8.1 | - |
| microsoft | windows_server_2008 | - |
| microsoft | windows_server_2008 | r2 |
| microsoft | windows_server_2008 | r2 |
| microsoft | windows_server_2012 | - |
| microsoft | windows_server_2012 | r2 |
| microsoft | windows_server_2016 | - |
| microsoft | windows_server_2016 | 1803 |
| microsoft | windows_server_2016 | 1903 |
| microsoft | windows_server_2019 | - |
GitHub Security Advisory GHSA-rchr-fxr5-m4xq
An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the...
References (2)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1365 Patch, Vendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1365 Patch, Vendor Advisory
Risk Scores
CVSS Score
9.9 / 10
EPSS Score
4.35%
Top 9% most likely to be exploited
Threat Score
40.9 / 100
Data Sources
NVD
EPSS
GitHub