CVE-2019-1437

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1433, CVE-2019-1435, CVE-2019-1438.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Windows	10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems
Microsoft	Windows Server	2019; 2019 (Core installation)
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1437Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1437Patch, Vendor Advisory

Timeline

Published: Nov 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-143706.5In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service.CVE-2019-143716.5An issue was discovered in Libav 12.3. There is an infinite loop in the function mov_probe in the file libavformat/mov.c, related to offset CVE-2019-143726.5In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.CVE-2019-143737.8An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a heap-base CVE-2019-143788.8ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the firs CVE-2019-143799.8SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache CVE-2019-14387.8An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi CVE-2019-143806.5libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.CVE-2019-143817.5libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrume CVE-2019-143826.5DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.CVE-2019-143836.5J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.CVE-2019-143865.4cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).