CVE-2019-1163

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A security feature bypass exists when Windows incorrectly validates CAB file signatures. An attacker who successfully exploited this vulnerability could inject code into a CAB file without invalidating the file's signature. To exploit the vulnerability, an attacker could modify a signed CAB file and inject malicious code. The attacker could then convince a target user to execute the file. The update addresses the vulnerability by correcting how Windows validates file signatures.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-354

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1703	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1803	>= 10.0.0, < publication
Microsoft	Windows Server, version 1803 (Server Core Installation)	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1809	>= 10.0.0, < publication
Microsoft	Windows Server 2019	>= 10.0.0, < publication
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1709 for 32-bit Systems	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1709	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1903 for 32-bit Systems	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1903 for x64-based Systems	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	>= 10.0.0, < publication
Microsoft	Windows Server, version 1903 (Server Core installation)	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1507	>= 10.0.0, < publication
Microsoft	Windows 10 Version 1607	>= 10.0.0, < publication
Microsoft	Windows Server 2016	>= 10.0.0, < publication
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.0, < publication

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1163Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1163Patch, Vendor Advisory

Timeline

Published: Aug 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-116328.1In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEd CVE-2019-116337.5HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com host CVE-2019-116349.8Citrix Workspace App before 1904 for Windows has Incorrect Access Control.CVE-2019-116367.5Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and "prevent any real transaction from occurring" via a "S CVE-2019-116376.5An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_rset_get_props at rec-rset.c in librec.CVE-2019-116386.5An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c CVE-2019-116398.8An issue was discovered in GNU recutils 1.8. There is a stack-based buffer overflow in the function rec_type_check_enum at rec-types.c in li CVE-2019-11647.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfu CVE-2019-116408.8An issue was discovered in GNU recutils 1.8. There is a heap-based buffer overflow in the function rec_fex_parse_str_simple at rec-fex.c in CVE-2019-116417.5Anomali Agave (formerly Drupot) through 1.0.0 fails to avoid fingerprinting by including predictable data and minimal variation in size with CVE-2019-116428.8A log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework before 5.1.10. Authenticated remote advers CVE-2019-116436.1Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10. Remote adversaries can inject malicious JavaScr