How to Fix CVE-2019-0803: Elevation of Privilege in Windows

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚠️ Patch immediately. CVE-2019-0803 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate.

What is CVE-2019-0803?

CVE-2019-0803 is a local elevation of privilege flaw in Win32k, the kernel-mode component (win32k.sys) that backs the Windows GUI subsystem. The MITRE description is precise: “An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.” Microsoft tracks it as the “Win32k Elevation of Privilege Vulnerability” and notes the ID is distinct from two sibling Win32k bugs patched the same month, CVE-2019-0685 and CVE-2019-0859.

Win32k runs in ring 0. When it mishandles an object in memory, a program that is already running on the box as a low-privileged user can drive that object into a corrupted state and execute its own code with SYSTEM rights. That is what the CVSS vector encodes: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — a local attack (AV:L) that needs an account on the machine (PR:L) but no user interaction (UI:N), and that fully compromises confidentiality, integrity, and availability once it lands.

This is not remote code execution. An attacker cannot use CVE-2019-0803 to break into a machine from the network. It is the second stage of an attack: malware or a logged-in adversary who already has a foothold uses it to jump from a normal user token to SYSTEM, defeating UAC, application whitelisting that runs per-user, and most endpoint controls. That is exactly why it is dangerous. CISA confirmed it is exploited in the wild and added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and a public proof-of-concept for the Win32k escalation was published on Packet Storm (linked in the references). Treat any unpatched, multi-user, or internet-facing host as a live target.

Am I affected?

The flaw is in the OS kernel, so every supported client and server SKU from that era is in scope: Windows 7 SP1, 8.1, RT 8.1, and Windows 10 builds 1607 through 1809 (x86, x64, and ARM64), plus Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, and 2019, including Server Core installations. There is no vulnerable third-party package to look for — it ships with the OS. What you are really checking is whether the host has the April 2019 (or any later) security update installed.

Run these from an elevated PowerShell prompt to read your build and your most recent patches:

# Your OS build and edition
[System.Environment]::OSVersion.Version
(Get-CimInstance Win32_OperatingSystem).Caption

# The 10 most recently installed updates, newest first
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 10

If the newest InstalledOn date predates April 2019, the machine almost certainly never received the fix for this CVE and is vulnerable.

How to fix CVE-2019-0803

Microsoft fixed CVE-2019-0803 in the April 2019 Patch Tuesday release (9 April 2019). There is no separate version string to compare against — the fix is delivered as the monthly cumulative update (Windows 10 / Server 2016/2019) or the monthly rollup / security-only update (Windows 7, 8.1, Server 2008–2012 R2) for your specific OS. Open the MSRC advisory, find your exact SKU, and note the KB number it lists (for example, KB4493472 for the Server 2012 R2 monthly rollup, KB4493448 for the Windows 8.1 security-only update, and the matching Windows 10 cumulative for your feature version). Because the fix has been superseded many times since 2019, installing the latest cumulative update for your OS also remediates it.

Option 1, Let Windows Update pull the latest cumulative (fastest)

On a single host, the simplest correct fix is to install all pending updates and reboot. Any cumulative from May 2019 onward already contains this fix.

# Run as Administrator
Install-Module -Name PSWindowsUpdate -Force -Scope CurrentUser
Import-Module PSWindowsUpdate
Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -Install -AutoReboot

No internet on the box? Use the built-in update agent against your WSUS server instead:

# Force a detect + install cycle against the configured update source (WSUS or Microsoft Update)
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall

Option 2: Install the exact KB offline (air-gapped or pinned builds)

For isolated systems, download the standalone .msu for your SKU from the Microsoft Update Catalog and install it with wusa.exe. Replace the KB number with the one the MSRC advisory lists for your OS.

# Example: Server 2012 R2 April 2019 monthly rollup is KB4493472.
# Look up YOUR SKU's KB at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803
$kb  = 'KB4493472'                       # <-- replace with the KB for your OS
$msu = "$env:TEMP\$kb.msu"               # download the .msu from catalog.update.microsoft.com first

# Install silently, then reboot to load the patched win32k.sys
Start-Process -FilePath 'wusa.exe' -ArgumentList "`"$msu`" /quiet /norestart" -Wait
Restart-Computer -Force

Option 3, Roll it out across a fleet

For domain environments, approve the relevant April 2019 (or later) updates in WSUS or push them through Microsoft Endpoint Configuration Manager (SCCM/MECM) as a software-update deployment. Confirm the security update classification is selected so the cumulative reaches every affected OS family. Because Win32k loads at boot, the patch only takes effect after a reboot — schedule a maintenance window so the new win32k.sys is actually running.

If you can't patch immediately

Microsoft published no workaround and no mitigation for CVE-2019-0803 — the security update is the only fix. There is no port to firewall and no service to disable, because the vulnerable code is the GUI kernel itself and the attack is local. The honest interim controls are operational, not configuration toggles:

• Reduce who can run code on the host. EoP needs an existing foothold. Remove interactive logon rights for non-admins on servers, and lock down which accounts can sign in to multi-user machines.
• Tighten application execution. Windows Defender Application Control or AppLocker policies that block untrusted binaries cut off the typical delivery vector for the low-privilege code that would chain into this escalation.
• Prioritise internet-facing and shared hosts. Terminal/RDS servers, jump boxes, and shared workstations are the highest-value targets for a SYSTEM escalation. Patch those first.
• Retire end-of-life builds. Windows 7, 8.1, Server 2008, and 2008 R2 are out of mainstream support. If you cannot apply the update on these, plan migration — they will keep accumulating unpatched kernel flaws.

Verify the fix

After the reboot, confirm the relevant KB is present. The check is a patch-presence check, not a version-string comparison:

# Confirm the specific KB (or any superseding cumulative) is installed
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 5

# Or test for one exact KB ID
if (Get-HotFix -Id KB4493472 -ErrorAction SilentlyContinue) {
    'Patched: KB4493472 present'
} else {
    'KB4493472 not found - check whether a later cumulative supersedes it'
}

Then re-run whichever vulnerability scanner first flagged the host and confirm the CVE-2019-0803 finding has cleared. Many scanners detect this through patch-level checks, so a stale result usually means the scan ran before the reboot completed. If the system handled untrusted users or untrusted code before patching, review it for signs of prior compromise, since a successful exploit leaves an attacker running as SYSTEM.

Frequently asked questions

Is CVE-2019-0803 remote code execution?

No. It is a local elevation of privilege bug in Win32k. An attacker cannot use it to gain initial access over the network — the CVSS vector is AV:L (local). It is used after a foothold exists to jump from a normal user to SYSTEM, which is why it is a favorite second-stage tool for malware and was added to CISA KEV.

What version fixes CVE-2019-0803?

There is no single fixed version number. Microsoft delivered the fix in the April 2019 Patch Tuesday updates (9 April 2019) as the per-OS cumulative update or monthly rollup. Look up your exact SKU in the MSRC advisory for its KB number, or simply install the latest cumulative update for your OS — every cumulative since May 2019 already includes this fix.

Do I need to reboot for the patch to take effect?

Yes. The vulnerable code lives in win32k.sys, a kernel driver loaded at boot. Installing the update stages the new file, but the patched kernel only runs after a restart. Plan a maintenance window; a host that has installed but not rebooted is still exploitable.

I'm on Windows 7 / Server 2008 R2 — can I still get the fix?

The April 2019 update covered Windows 7 SP1 and Server 2008/2008 R2 at the time. Those products have since reached end of support, so without an Extended Security Updates contract you will not receive new fixes for later kernel flaws. The right long-term answer for these SKUs is migration to a supported OS.

References

• Official vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-0803
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Additional reference: http://packetstormsecurity.com/files/153034/Microsoft-Windows-Win32k-Privilege-Escalation.html

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Additional nearby issues sensible to fix in the same maintenance window:

• How to Fix CVE-2019-0543: Improper Authentication in Microsoft Windows
• How to Fix CVE-2019-0797: Elevation of Privilege in Windows Server
• How to Fix CVE-2019-1253: Improper Link Resolution Before File Access in Microsoft Windows
• How to Fix CVE-2019-0880: Elevation of Privilege in Microsoft Windows
• How to Fix CVE-2019-0752: Access of resource using incompatible type in Internet Explorer 10