CVE-2019-1409

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists when the Windows Remote Procedure Call (RPC) runtime improperly initializes objects in memory, aka 'Windows Remote Procedure Call Information Disclosure Vulnerability'.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-665

Affected software

VendorProductVersions
MicrosoftWindows7 for 32-bit Systems Service Pack 1; 7 for x64-based Systems Service Pack 1; 8.1 for 32-bit systems; 8.1 for x64-based systems; RT 8.1; 10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for ARM64-based Systems
MicrosoftWindows Server2008 R2 for x64-based Systems Service Pack 1 (Core installation); 2008 R2 for Itanium-Based Systems Service Pack 1; 2008 R2 for x64-based Systems Service Pack 1; 2008 for 32-bit Systems Service Pack 2 (Core installation); 2012; 2012 (Core installation); 2012 R2; 2012 R2 (Core installation); 2016; 2016 (Core installation); version 1803 (Core Installation); 2019; 2019 (Core installation); 2008 for Itanium-Based Systems Service Pack 2; 2008 for 32-bit Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2; 2008 for x64-based Systems Service Pack 2 (Core installation)
MicrosoftWindows 10 Version 1903 for 32-bit Systemsunspecified
MicrosoftWindows 10 Version 1903 for x64-based Systemsunspecified
MicrosoftWindows 10 Version 1903 for ARM64-based Systemsunspecified
MicrosoftWindows Server, version 1903 (Server Core installation)unspecified

References

Timeline

Published
Nov 12, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-140917.8Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdragon Compute, SnapdragoCVE-2019-140925.5System Services exports services without permission protect and can lead to information exposure in Snapdragon Industrial IOT, Snapdragon MoCVE-2019-140937.8Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon ConCVE-2019-140947.8Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet in Snapdragon Auto, CVE-2019-140959.8Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in Snapdragon CVE-2019-140979.8Possible buffer overflow in WLAN Parser due to lack of length check when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon ConCVE-2019-140989.8Possible buffer overflow in data offload handler due to lack of check of keydata length when copying data in Snapdragon Auto, Snapdragon ComCVE-2019-140997.8Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, SnapdragonCVE-2019-141007.8Register write via debugfs is disabled by default to prevent register writing via debugfs. in Snapdragon Auto, Snapdragon Compute, SnapdragoCVE-2019-141017.1Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than expected CVE-2019-141047.1Slab-out-of-bounds access can occur if the context pointer is invalid due to lack of null check on pointer before accessing it in SnapdragonCVE-2019-141057.8Kernel was reading the CSL defined reserved field as uint16 instead of uint32 which could lead to memory overflow in Snapdragon Industrial I
CVE-2019-1409: Medium severity, CVSS 5.5 | Vulnix