Loading vulnerability…
CVE-2019-1458 is a local elevation-of-privilege vulnerability in the Windows Win32k kernel component caused by improper handling of objects in memory. Available technical reporting describes it as an arbitrary pointer dereference in win32k.sys tied to insufficient validation in window-management logic. The vulnerable path involves manipulation of window class state and extra window data through Win32k system calls, including transitions into the Switch window class and subsequent use of SetWindowLongPtr-related functionality. By steering the kernel to dereference or write through an attacker-controlled pointer during window painting logic, an attacker can obtain kernel arbitrary read/write primitives. Public analyses indicate the exploit was then used to locate and replace process tokens in kernel memory, resulting in privilege escalation to SYSTEM. The flaw was observed in the wild as part of exploit chains following browser compromise, where it was used to escape a sandboxed context and launch additional malware with elevated privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module implementing a local privilege escalation exploit for CVE-2019-1458, also known as 'WizardOpium'. The exploit targets a vulnerability in the Windows kernel driver win32k.sys, allowing a local attacker to gain SYSTEM privileges by exploiting an uninitialized variable. The module is written in Ruby and is designed to be used within the Metasploit Framework. It checks the version of win32k.sys to determine if the target is vulnerable, and if so, uses reflective DLL injection to execute a payload (such as Meterpreter) as SYSTEM. The exploit is primarily tested against Windows 7 x64 SP1 but includes version checks for a range of Windows versions from Vista through early Windows 10 builds. The main fingerprintable endpoints are the win32k.sys driver file and the DLL used for exploitation. The exploit is operational and can be used to gain full control over a vulnerable Windows system.
This repository contains a local privilege escalation exploit for CVE-2019-1458, targeting several 64-bit versions of Microsoft Windows (Windows 7, 8, 2008, 2012, and their R2 variants). The exploit is implemented in C++ (Source.cpp) with supporting assembly (shellcode.asm) for direct system calls. The exploit abuses a vulnerability in the Windows kernel to escalate privileges and execute an arbitrary command as SYSTEM, provided as a command-line argument. The exploit must be run locally and only works once per system reboot. The project is structured as a Visual Studio solution with the main logic in Source.cpp and supporting build files. No network endpoints are involved; the attack vector is purely local. The exploit is operational, requiring the attacker to supply the desired command to be executed with SYSTEM privileges.
This repository provides a proof-of-concept (POC) exploit for CVE-2019-1458, a local privilege escalation vulnerability in Microsoft Windows 7 SP1 x64 (win32k.sys). The repository contains three files: a detailed README.md explaining the vulnerability and exploit development process, a C++ source file (cve-2019-1458.cpp) implementing the exploit logic, and an assembly file (syscall.asm) providing a direct syscall stub for NtUserMessageCall. The exploit works by creating a specially crafted window, manipulating its extra data, simulating an ALT key press, and making specific calls to the undocumented NtUserMessageCall API to trigger a double dereference in the kernel. This results in memory corruption, which can be leveraged for privilege escalation. The exploit is a POC and does not provide a full shell or privilege escalation chain, but demonstrates the core vulnerability. The attack vector is local, requiring code execution on the target system. The exploit targets unpatched Windows 7 SP1 systems (prior to KB4530692).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously reported vulnerability in Purple Fox's exploit arsenal, mentioned as background context.
A Microsoft Windows win32k privilege escalation zero-day used alongside a Chrome exploit in Operation WizardOpium.
Windows local privilege escalation vulnerability incorporated into DirtyMoe's SQL worming payloads to help achieve elevated execution for installation.
A privilege escalation vulnerability leveraged by the Antlion threat actor to help execute the xPack backdoor; the article notes it was included on CISA's list of actively exploited flaws.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.