CVE-2019-1088

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1086, CVE-2019-1087.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftWindows7 for 32-bit Systems Service Pack 1; 7 for x64-based Systems Service Pack 1; 8.1 for 32-bit systems; 8.1 for x64-based systems; RT 8.1; 10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 10 Version 1703 for 32-bit Systems; 10 Version 1703 for x64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for ARM64-based Systems
MicrosoftWindows Server2008 R2 for x64-based Systems Service Pack 1 (Core installation); 2008 R2 for Itanium-Based Systems Service Pack 1; 2008 R2 for x64-based Systems Service Pack 1; 2008 for 32-bit Systems Service Pack 2 (Core installation); 2012; 2012 (Core installation); 2012 R2; 2012 R2 (Core installation); 2016; 2016 (Core installation); version 1803 (Core Installation); 2019; 2019 (Core installation); 2008 for Itanium-Based Systems Service Pack 2; 2008 for 32-bit Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2 (Core installation)
MicrosoftWindows 10 Version 1903 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1903 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1903 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1903 (Server Core installation)unspecified

References

Timeline

Published
Jul 15, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-108809.8Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "CVE-2019-108819.8Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includeCVE-2019-108827.8The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections CVE-2019-108839.8Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection.CVE-2019-108848.8Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vulCVE-2019-108857.8An issue was discovered in Ivanti Workspace Control before 10.3.90.0. Local authenticated users with low privileges in a Workspace Control mCVE-2019-108865.9An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV anCVE-2019-108876.1A reflected HTML injection vulnerability on Salicru SLC-20-cube3(5) devices running firmware version cs121-SNMP v4.54.82.130611 allows remotCVE-2019-108888.8A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html.CVE-2019-10897.8An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request. To expCVE-2019-108919.8An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checkingCVE-2019-108929.8An issue was discovered in D-Link DIR-806 devices. There is a stack-based buffer overflow in function hnap_main at /htdocs/cgibin. The funct
CVE-2019-1088: High severity, CVSS 7.8 | Vulnix