CVE-2019-0880: Microsoft Windows Privilege Escalation Vulnerability

CVE-2019-0880 is a local elevation of privilege vulnerability in Microsoft Windows that involves how splwow64.exe handles certain calls. An attacker who already has a foothold at low integrity on an affected system could use a successful exploit to raise privileges to medium integrity. This matters because privilege escalation is a common step after initial access: it can let an adversary move from a constrained process or user context toward broader control of the host, install persistence, or reach data and tools that were previously out of reach.

Defenders should treat it as a post-compromise enabler rather than a remote entry point. Confirm exact product applicability, fixed builds, and deployment guidance only against the Microsoft advisory for this CVE.

How it works

The flaw is a local elevation of privilege issue centered on splwow64.exe, a Windows component involved in print-related and 32/64-bit interoperability paths. Public detail describes that the binary mishandles certain calls in a way that allows an attacker operating at low integrity to obtain medium integrity on the same system.

In practical terms, an adversary who can already run code in a low-integrity context (for example after landing via a separate vulnerability, malicious document, or limited user session) attempts to abuse the vulnerable handling path. Success yields higher integrity, which expands what the attacker can read, write, or execute under Windows integrity and privilege models. The CWE class is not specified in the provided record; treat it generically as a local privilege-escalation weakness in a system binary and verify any deeper root-cause notes in the vendor advisory. No remote unauthenticated exploitation path is described in the given facts.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows. splwow64.exe is a standard component on many Windows installations that support printing and WoW64 scenarios, so inventory should cover workstations and servers that run Windows and have the print subsystem or related features present.

• Build an inventory of Windows endpoints and servers (asset management, CMDB, EDR, or PowerShell/WMI queries for OS version and presence of splwow64.exe under System32/SysWOW64).
• Map each host to the Microsoft security update that addresses CVE-2019-0880; do not assume version ranges—confirm against the vendor advisory and your patch baseline.
• Check whether print spooler or related services are enabled; systems that never use printing may still carry the binary, so absence of active printing is not proof of non-exposure.
• For exploitation signs, review EDR/process telemetry for unusual child processes, integrity-level changes, or unexpected calls involving splwow64.exe from low-integrity parents; Windows security event logs for privilege-related events and process creation; and any alerts tied to local elevation after a low-integrity process start. Correlate with other initial-access indicators rather than relying on a single signature.

If your environment uses third-party print or virtualization layers that interact with Windows printing, include those hosts in scope and validate with the vendor advisory.

How to remediate

Patch first. Apply the Microsoft updates that address CVE-2019-0880 exactly as directed in the vendor advisory and CISA’s required action (“Apply updates per vendor instructions”). Use your standard test-and-deploy pipeline, prioritize internet-facing or high-value systems that already allow local code execution by untrusted users, then roll out broadly.

• After patching, verify the update is installed (hotfixes, build numbers, or Microsoft’s own verification guidance) and reboot if required by the package.
• Reduce standing local admin and unnecessary Se* privileges so that even successful elevation has less impact.
• Enforce application control and least-privilege execution so low-integrity or untrusted processes cannot freely invoke sensitive system binaries.
• Keep the print spooler and related services disabled or restricted on servers that do not need them, following Microsoft hardening guidance for the print stack.
• Maintain current EDR/AV signatures and ensure tamper protection is on so post-exploitation tools are harder to run after any elevation.

If you can't patch immediately

Until the vendor update is deployed, shrink the attack surface and improve detection.

• Segment and restrict local logon and code-execution paths for untrusted users; limit who can run arbitrary processes on multi-user or VDI hosts.
• Disable or constrain the print spooler and related features on systems that do not require printing; remove unnecessary print drivers and remote print capabilities.
• Apply application-control policies that block untrusted callers from launching or interacting with splwow64.exe where operationally feasible.
• Increase monitoring on process creation, integrity-level transitions, and parent-child relationships involving splwow64.exe; alert on anomalies and retain logs for incident response.
• Virtual patching via host firewall or EDR behavioral rules can reduce abuse of the component but is not a substitute for the official update—confirm any rule content against vendor and community guidance for this class of local EoP.
• Revisit least-privilege and remove standing admin rights so a jump from low to medium integrity does not immediately yield full administrative control.

Track the exception with a clear deadline to patch; compensating controls degrade over time as attackers adapt.

If your data may have been exposed

Local elevation vulnerabilities are frequently chained after initial access and can contribute to broader compromise, data theft, or ransomware staging even when ransomware use is not specifically documented for this CVE. If you have indicators of exploitation or unexplained privilege changes on affected hosts, follow your incident-response process: isolate, preserve evidence, rotate credentials, and hunt for lateral movement. As a quick personal check, individuals can run a free exposure scan of their email addresses against known breach datasets to see whether their credentials already appear in public dumps, then force password changes and enable MFA where needed.