CVE-2019-1161
Microsoft Defender Elevation of Privilege Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- microsoft
Description
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the vulnerability and delete protected files on an affected system once MpSigStub.exe ran again. The update addresses the vulnerability and blocks the arbitrary deletion.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.95% · top 39% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
- Elevation of Privilege
Affected products
Microsoft · Microsoft Forefront Endpoint Protection 2010
- affected N/A
Microsoft · Microsoft System Center Endpoint Protection
- affected N/A
Microsoft · Microsoft System Center 2012 R2 Endpoint Protection
- affected N/A
Microsoft · Microsoft Security Essentials
- affected N/A
Microsoft · Microsoft System Center 2012 Endpoint Protection
- affected N/A
- affected N/A
References (1)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1161 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-1161)Record last updated .