How to Fix CVE-2019-0797: Win32k Elevation of Privilege in Windows

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚠️ Patch immediately. CVE-2019-0797 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate.

What is CVE-2019-0797?

CVE-2019-0797 is an elevation-of-privilege flaw in Win32k, the kernel-mode graphics and windowing subsystem (win32k.sys) that ships with every supported edition of Windows. The vulnerability exists because Win32k fails to properly handle objects in memory. An attacker who already has the ability to run code on the machine (an ordinary logged-in user, a low-privilege service account, or malware dropped through a separate foothold) can abuse that flawed object handling to run arbitrary code in kernel mode. Once code runs in the kernel, the attacker effectively owns the box: install programs; view, change, or delete data; or create new accounts with full administrator rights.

This is not a remote-code-execution bug and it is not a denial-of-service bug. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: local attack vector, low complexity, and low privileges already required, with high impact to confidentiality, integrity, and availability. In the real world, Win32k privilege-escalation bugs like this one are the second half of an exploit chain. The first stage gets code onto the machine (a malicious document, a drive-by, a phishing payload), and CVE-2019-0797 is what turns that limited code execution into SYSTEM. Microsoft published it on the March 2019 Patch Tuesday and explicitly notes the CVE is distinct from CVE-2019-0808, a separate Win32k EoP fixed in the same release.

Microsoft's advisory title for this entry is "Win32k Elevation of Privilege Vulnerability." It was reported as an in-the-wild zero-day, which is why CISA later placed it in the Known Exploited Vulnerabilities catalog. Treat any unpatched affected host as a privilege-escalation primitive already available to anyone who gains even a toehold on it.

Am I affected?

There are no clean runtime "symptoms" for a kernel EoP. A working exploit leaves no banner and usually no obvious crash. You are affected purely by build: any of the Windows client or Windows Server editions in the Affected row that has not received the March 2019 (or any later) cumulative or security-only update. To check, confirm your OS build and the last installed quality update from an elevated PowerShell prompt:

# Identify the exact OS build and edition
Get-ComputerInfo -Property OsName, OsVersion, OsBuildNumber, WindowsVersion

# List the most recent installed updates; a build at or past the
# March 2019 cumulative for your OS line is patched
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15

If the newest InstalledOn date predates March 2019, or the machine has never been patched since imaging, assume it is vulnerable and remediate.

How to fix CVE-2019-0797

There is one supported fix: install the Microsoft security update that corresponds to your exact Windows build. This is delivered as a Windows quality update (a cumulative update for Windows 10 / Server 2016+ and 8.1 / Server 2012, or a security-only package for the older monthly model), not as a standalone .msi or a Linux package. The KB number differs per OS line. Look it up on the MSRC advisory for CVE-2019-0797, which lists the KB for every affected edition, or simply install the latest cumulative update, since later cumulatives are inclusive of this fix.

Option A: Windows Update (recommended for most hosts)

The simplest path is to let Windows Update pull the current cumulative update, which supersedes the March 2019 fix. On a server with internet access or a WSUS connection:

# Run from an elevated PowerShell session.
# PSWindowsUpdate is a community module that wraps the Windows Update agent.
Install-Module -Name PSWindowsUpdate -Force -Scope CurrentUser
Import-Module PSWindowsUpdate
Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -Install -AutoReboot

If you manage patching centrally, approve the March 2019 (or any later) cumulative for the affected OS lines in WSUS / SCCM / Intune and let your normal ring deployment carry it.

Option B: install the specific KB offline

For isolated or air-gapped servers, download the exact MSU for your build from the Microsoft Update Catalog and apply it with wusa.exe. Replace the KB number with the one listed for your OS in the MSRC advisory (for example, the March 2019 cumulative for Windows Server 2019 / Windows 10 1809 was KB4489899; the security-only package for Server 2012 R2 was KB4489881. Always confirm the value for your build against the advisory):

# 1. Look up the KB for YOUR build in the MSRC advisory, then search the catalog:
#    https://www.catalog.update.microsoft.com/Search.aspx?q=KB4489899
# 2. Download the matching .msu for your architecture and OS line, then install:
$msu = "$env:TEMP\windows-update.msu"   # path to the .msu you downloaded
Start-Process -FilePath "wusa.exe" -ArgumentList "`"$msu`" /quiet /norestart" -Wait

# 3. Reboot to finish servicing; Win32k changes take effect after restart
Restart-Computer -Force

Verify the fix

Win32k is patched in-place inside the OS; there is no separate product version to read. Confirm the relevant KB is now present and the build moved forward:

# Confirm the specific KB applied (substitute your KB number)
Get-HotFix -Id KB4489899 -ErrorAction SilentlyContinue

# Or just confirm the build is at/after the March 2019 cumulative for your line
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

# Optionally confirm the patched win32kfull.sys / win32k.sys file version
Get-Item C:\Windows\System32\win32kfull.sys | Select-Object -ExpandProperty VersionInfo

A successful patch shows the expected KB with a recent InstalledOn date. If you applied a later cumulative instead of the original March 2019 KB, that is fine: the supersedence chain covers this CVE.

If you can't patch immediately

Microsoft published no workaround and no mitigating factor for CVE-2019-0797. The advisory's only documented remediation is the security update. Because this is a local kernel EoP rather than a network-exposed service, firewall rules and port restrictions do nothing to block it; the attacker already has local code execution before they reach Win32k. Until you can apply the update, lean on defense in depth that limits who can run code on the host in the first place.

• Reduce who can log on. Audit interactive and service logon rights on the affected servers and remove any account that does not strictly need them. The exploit needs a local foothold; fewer footholds, less exposure.
• Keep endpoint protection current. Microsoft Defender and most EDR vendors shipped detections for the in-the-wild Win32k exploit chain. Make sure signatures and behavioral protection are enabled and updating on every affected host.
• Enforce application control. WDAC / AppLocker or equivalent allow-listing blocks the first-stage payload that the exploit relies on, breaking the chain before Win32k is reached.
• Prioritize internet-reachable and multi-user hosts. Terminal/RDS servers and any machine where untrusted users get a session are the highest-value targets for a privilege-escalation bug; patch those first.

None of these is a substitute for the update. Schedule the patch as an emergency change given the active-exploitation status.

Confirm you are clear

After the reboot, run the hotfix probe one more time and confirm the relevant KB (or a later superseding cumulative) is present:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

Expected result: the March 2019 KB for your OS line (or any cumulative dated after it) appears with an InstalledOn date inside your patch window. Then re-run whatever vulnerability scanner first flagged the host (Defender for Endpoint, Nessus, Qualys, etc.) and confirm the CVE-2019-0797 finding has cleared. Because this was an in-the-wild zero-day, sweep affected hosts for signs of prior compromise (unexpected new local administrators, suspicious scheduled tasks, and EDR alerts on Win32k exploitation), especially on machines that went unpatched after March 2019.

Frequently asked questions

Is CVE-2019-0797 being actively exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog, which means in-the-wild exploitation has been observed and confirmed.

How severe is CVE-2019-0797?

CVSS rates it 7.8 (High). Use that score to set your patch priority next to the other items in your queue.

Can CVE-2019-0797 be exploited remotely over the network?

No. The CVSS attack vector is Local (AV:L) and the attacker already needs the ability to run code as some user on the machine. CVE-2019-0797 is a privilege-escalation step, not a remote entry point. It is typically chained after a separate initial-access bug to jump from a low-privilege account to SYSTEM. That is also why firewall rules and port blocking do not mitigate it.

What is the difference between CVE-2019-0797 and CVE-2019-0808?

Both are Win32k elevation-of-privilege vulnerabilities patched in the same March 2019 release, and Microsoft's record explicitly notes they are distinct CVE IDs covering separate defects in the kernel-mode component. Installing the March 2019 cumulative for your OS line addresses both, so you do not patch them separately.

I keep my servers patched monthly: am I still exposed?

If every affected host has received any Windows quality update from March 2019 onward, the fix is already in place through update supersedence; you do not need the original KB specifically. The risk lives on machines that were imaged once and never patched, or that fell out of your update rings. Use the Get-HotFix probe above to find stragglers.

References

• Official vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0797
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-0797
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Related weaknesses in the same component worth addressing at the same time:

• How to Fix CVE-2019-0859: Elevation of Privilege in Windows
• How to Fix CVE-2019-1315: Improper Link Resolution Before File Access in Microsoft Windows
• How to Fix CVE-2019-1253: Improper Link Resolution Before File Access in Microsoft Windows
• How to Fix CVE-2019-0863: Elevation of Privilege in Windows
• How to Fix CVE-2019-1388: Improper Privilege Management in Windows