Loading story…
Microsoft patched CVE-2019-0859, a win32k.sys elevation-of-privilege flaw that Kaspersky said was exploited in the wild to give attackers higher privileges on affected Windows systems. The bug was a use-after-free condition in the CreateWindowEx path tied to WM_NCCREATE handling and manipulation of a window Function ID, allowing a freed window object to be reused for privilege escalation. Microsoft tracked the issue as a Win32k Elevation of Privilege Vulnerability in its Security Update Guide.
Kaspersky reported attacks against 64-bit Windows systems ranging from Windows 7 to older Windows 10 builds, with exploitation observed in March 2019. According to the report, the exploit used HMValidateHandle to help bypass ASLR, then launched PowerShell to fetch additional payload stages; the final payload unpacked shellcode and opened an HTTP reverse shell, giving the attacker full control of the compromised machine.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Kaspersky Lab disclosed the win32k.sys vulnerability to Microsoft on March 17, 2019. Microsoft assigned the flaw CVE-2019-0859 and confirmed the vulnerability.
In March 2019, Kaspersky Lab detected an exploitation attempt against Microsoft Windows through its automatic Exploit Prevention systems. Further analysis led the company to identify a zero-day local privilege escalation vulnerability in win32k.sys that was being exploited in the wild.
After Kaspersky's disclosure, Microsoft released a security update to fix CVE-2019-0859, a Win32k elevation of privilege vulnerability. Microsoft also credited Kaspersky researchers Vasiliy Berdnikov and Boris Larin for the discovery.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky Lab disclosed that attackers exploited a Windows zero-day later assigned **`CVE-2018-8589`**, a race condition in **`win32k.sys`** tied to **`win32k!xxxMoveWindow`**, before Microsoft issued a patch in its security bulletin. The exploit was detected in the wild after Kaspersky's Automatic Exploit Prevention flagged activity in October 2018, indicating active abuse rather than a purely theoretical flaw. The exploit was used by the first stage of a malware installer to gain elevated privileges and establish persistence on compromised systems. Kaspersky said the observed campaign was limited in scope, with known victims located in the Middle East, and that the in-the-wild exploit specifically targeted **32-bit Windows 7** systems.
Aug 14, 2026
Microsoft published security advisories for two **Win32k Elevation of Privilege** flaws, tracked as `CVE-2023-36011` and `CVE-2024-43636`, in its Security Update Guide. Both issues affect the Windows **Win32k** subsystem, a core component involved in graphical and kernel-level operations, and successful exploitation could allow an attacker to gain elevated privileges on a targeted system. The advisories indicate that Microsoft addressed the vulnerabilities through security updates and added them to its official guidance portal for customer remediation. Organizations running affected Windows systems should review the relevant Microsoft advisories, verify patch deployment, and prioritize remediation because privilege-escalation flaws in **Win32k** are commonly valuable for post-compromise activity and local escalation chains.
Jul 12, 2026
Microsoft has disclosed a critical elevation-of-privilege vulnerability in the Windows Kernel, tracked as CVE-2025-62215, which is being actively exploited in the wild. The flaw arises from a race condition and improper memory management, specifically a double-free scenario, allowing local attackers to escalate privileges to SYSTEM level. Exploitation requires an attacker to already have access to the system, but no user interaction is needed, and the attack can be automated. Microsoft has rated the vulnerability as Important, with a CVSS score of 7.0, and notes that all supported Windows 10 editions are affected, including those under Extended Security Updates (ESU). No workaround is available other than applying the official update, and immediate patching is strongly recommended. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-415 (Double Free), making it a classic post-compromise privilege escalation vector. Attackers can exploit the timing-sensitive memory corruption path in the kernel to gain elevated access, disable security defenses, and move laterally within networks. The attack surface is particularly concerning in enterprise environments where multiple users share access, as any authenticated user can potentially trigger the exploit. Security experts warn that both targeted threat actors and ransomware operators may leverage this flaw to deepen their foothold after initial access, emphasizing the urgency of deploying the security update across all affected systems.
Jul 12, 2026