CVE-2019-1255

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
MicrosoftMicrosoft Security Essentialsunspecified
MicrosoftMicrosoft System Center2012 Endpoint Protection; Endpoint Protection; 2012 R2 Endpoint Protection
MicrosoftMicrosoft Forefront Endpoint Protection2010
MicrosoftWindows Defender on Windows 7 for 32-bit SystemsService Pack 1
MicrosoftWindows Defender on Windows 7 for x64-based SystemsService Pack 1
MicrosoftWindows Defender on Windows Server 2008 R2 for x64-based Systems (Server Core installation)Service Pack 1
MicrosoftWindows Defender on Windows Server 2008 R2 for Itanium-Based SystemsService Pack 1
MicrosoftWindows Defender on Windows Server 2008 R2 for x64-based SystemsService Pack 1
MicrosoftWindows Defender on Windows Server 2008 for 32-bit Systems (Server Core installation)Service Pack 2
MicrosoftWindows Defender on Windows Server 2012unspecified
MicrosoftWindows Defender on Windows Server 2012 (Server Core installation)unspecified
MicrosoftWindows Defender on Windows 8.1 for 32-bit systemsunspecified
MicrosoftWindows Defender on Windows 8.1 for x64-based systemsunspecified
MicrosoftWindows Defender on Windows Server 2012 R2unspecified
MicrosoftWindows Defender on Windows RT 8.1unspecified
MicrosoftWindows Defender on Windows Server 2012 R2 (Server Core installation)unspecified
MicrosoftWindows Defender on Windows 10 for 32-bit Systemsunspecified
MicrosoftWindows Defender on Windows 10 for x64-based Systemsunspecified
MicrosoftWindows Defender on Windows Server 2016unspecified
MicrosoftWindows Defender on Windows 10 Version 1607 for 32-bit Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1607 for x64-based Systemsunspecified
MicrosoftWindows Defender on Windows Server 2016 (Server Core installation)unspecified
MicrosoftWindows Defender on Windows 10 Version 1703 for 32-bit Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1703 for x64-based Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1709 for 32-bit Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1709 for x64-based Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1803 for 32-bit Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1803 for x64-based Systemsunspecified
MicrosoftWindows Defender on Windows Server, version 1803 (Server Core Installation)unspecified
MicrosoftWindows Defender on Windows 10 Version 1803 for ARM64-based Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1809 for 32-bit Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1809 for x64-based Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1809 for ARM64-based Systemsunspecified
MicrosoftWindows Defender on Windows Server 2019unspecified
MicrosoftWindows Defender on Windows Server 2019 (Server Core installation)unspecified
MicrosoftWindows Defender on Windows 10 Version 1709 for ARM64-based Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1903 for 32-bit Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1903 for x64-based Systemsunspecified
MicrosoftWindows Defender on Windows 10 Version 1903 for ARM64-based Systemsunspecified
MicrosoftWindows Defender on Windows Server, version 1903 (Server Core installation)unspecified
MicrosoftWindows Defender on Windows Server 2008 for Itanium-Based SystemsService Pack 2
MicrosoftWindows Defender on Windows Server 2008 for 32-bit SystemsService Pack 2

References

Timeline

Published
Sep 23, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-125509.8WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to lCVE-2019-125515.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scriCVE-2019-125525.5In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of servCVE-2019-125539.8In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scriCVE-2019-125547.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scrCVE-2019-125557.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scriCVE-2019-12567.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2019-125626.1Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into thCVE-2019-125649.8In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backuCVE-2019-125665.4The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an accounCVE-2019-125679.8Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a deniCVE-2019-125689.8Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attackers to perform a deni
CVE-2019-1255: High severity, CVSS 7.5 | Vulnix