Loading vulnerability…
CVE-2019-0808 is a local elevation of privilege vulnerability in the Windows Win32k kernel component caused by improper handling of objects in memory. The flaw allows a locally executing attacker to exploit memory corruption in Win32k to elevate privileges from a lower-privileged context to a more privileged one, typically kernel-level or SYSTEM-equivalent execution. Public reporting and observed exploitation indicate it has been used as a post-compromise privilege-escalation primitive in malware and exploit chains, including campaigns that first achieved code execution through browser exploitation and then invoked CVE-2019-0808 to escape user-mode restrictions and complete payload installation. The issue is distinct from CVE-2019-0797.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (modules/exploits/windows/local/ntusermndragover.rb) that exploits CVE-2019-0808, a NULL pointer dereference vulnerability in the Windows kernel (win32k.sys) via the NtUserMNDragOver system call. The exploit targets Windows 7 x86 (32-bit) systems, specifically versions 7600 and 7601 (SP0 and SP1), and requires a Meterpreter session on the target. The module checks the OS version and the win32k.sys driver revision to ensure the target is vulnerable. Upon exploitation, it reflectively injects a DLL containing the payload, which is executed with SYSTEM privileges. The module is operational and provides privilege escalation capabilities. The only fingerprintable endpoints are the system file win32k.sys (for version checking) and the DLL used for exploitation. The structure is typical for a Metasploit local privilege escalation module, with clear separation of check and exploit logic.
This repository contains a proof-of-concept (POC) exploit for CVE-2019-0808, a Windows kernel vulnerability. The structure includes Visual Studio solution and project files for both x86 and x64 builds, with the main exploit logic implemented in 'exp.cpp' for each architecture. The exploit is a local denial-of-service attack: when executed on a vulnerable Windows 7 system, it manipulates Windows menu structures and window procedures to trigger a Blue Screen of Death (BSOD), causing the system to reboot. The code does not attempt privilege escalation or remote code execution, and is intended for demonstration and research purposes only. The repository does not contain any network endpoints or remote attack vectors; all actions are performed locally via Windows API calls. The exploit requires compilation and execution on the target system. The payload is written in C++ and leverages low-level Windows API functions, including dynamic loading of USER32.dll and ntdll.dll. The repository is organized with separate directories for x86 and x64 builds, each containing the necessary project, build, and source files.
This repository contains a full chain exploit targeting Google Chrome 72.0.3626.119 on Windows 7 x86, leveraging CVE-2019-5786 (Chrome renderer use-after-free) and CVE-2019-0808 (Windows kernel privilege escalation). The structure is as follows: - The 'FullChainChromeExploit' directory contains a Visual Studio C++ project that builds a DLL (payload) which, when executed, launches cmd.exe on the victim's system. The main exploit logic is in 'dllmain.cpp'. - The 'host1_wrapper' directory contains 'iframe.html', which repeatedly loads the exploit in an iframe from a second host. The URL for the exploit iframe is hardcoded as 'http://192.168.232.129:8000/exploit.html' but can be changed. - The 'host2_single_run' directory contains the actual browser exploit chain: 'exploit.html' loads 'exploit.js' (the main JavaScript exploit), a WebAssembly module ('wasm/helloo.js'), and a shellcode loader ('shellcode.js', not included in the provided content). The JavaScript exploits the Chrome renderer bug to achieve arbitrary read/write, then uses a converted DLL shellcode to escape the sandbox and execute code at the OS level. The exploit requires the attacker to serve 'host1_wrapper' and 'host2_single_run' from different origins, leveraging site isolation. The victim must visit 'iframe.html', which triggers the exploit chain. If successful, the payload launches a command shell on the victim's Windows 7 x86 system. The repository demonstrates a sophisticated, multi-stage browser-to-kernel exploit chain.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Win32k kernel local privilege escalation vulnerability used by Purple Fox to elevate privileges via publicly available exploit code.
A vulnerability used by the Underminer exploit kit as part of its exploit chain targeting Chromium-based browsers, but not analyzed in detail in this content.
A Windows privilege escalation vulnerability checked by the PurpleFox delivery script for use on older Windows systems.
A privilege escalation vulnerability listed as one of the integrated exploits used by Purple Fox during later infection stages.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.