CVE-2019-0880

What it actually does

Local attacker with low privileges can abuse improper handling of calls in splwow64.exe to escalate to SYSTEM-level privileges on affected Windows systems.

Why it matters to the business

Attackers who already have a foothold on a machine can obtain full administrative control, enabling data theft, ransomware deployment, or long-term persistence; KEV listing and past ransomware relevance increase urgency for large Windows fleets.

How an attack unfolds

An attacker with local low-privilege access invokes splwow64.exe through crafted calls that trigger the elevation-of-privilege flaw, obtaining SYSTEM rights and then installing tools or moving laterally.

How to fix it

Apply the security update addressing CVE-2019-0880 for each affected Windows version; replace end-of-support releases with currently supported builds and enable automatic updates.

How to confirm the fix worked

Confirm the presence of the relevant Microsoft security update via Get-Hotfix or WSUS reporting; re-test the splwow64.exe binary version against the patched release.

Typical attack path

1. Obtain initial local access via phishing, malicious document, or compromised account
2. Execute code that interacts with splwow64.exe using malicious parameters
3. Trigger the call-handling flaw to elevate from user to SYSTEM privileges
4. Install additional payloads or perform post-exploitation actions with full rights

How to detect it

Review Windows Security event logs and Sysmon process-creation events for unusual invocations or child processes of splwow64.exe; correlate with post-escalation activity such as unexpected service installations or credential dumping.

• splwow64.exe
• Process Create.*splwow64.exe
• splwow64.exe.*-Embedding

What your security team should do

• Treat as high priority because of KEV inclusion and known in-the-wild exploitation
• Deploy patches across all listed Windows 8.1/10/Server 2012/2016/2019 systems immediately
• Harden local privilege boundaries with AppLocker or WDAC to reduce attack surface
• Audit privileged account usage and monitor for anomalous splwow64.exe activity