CVE-2019-1388

Microsoft Windows, Microsoft Windows Server, Microsoft Windows 10 Version 1903 for 32-bit Systems

Published 12 Nov 2019 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 7 Apr 2023, with a remediation deadline of 28 Apr 2023 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.

References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388 · Patch, Vendor Advisory
www.zerodayinitiative.com/advisories/ZDI-19-975/ · Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1388 · US Government Resource