What’s Vulnerable › Vulnerabilities

CVE-2019-1029: Skype for Business and Lync Server Denial of Service Vulnerability

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-12 · updated 2026-06-17

Description

A denial of service vulnerability exists in Skype for Business. An attacker who successfully exploited the vulnerability could cause Skype for Business to stop responding. Note that the denial of service would not allow an attacker to execute code or to elevate the attacker's user rights. To exploit the vulnerability, an attacker needs to obtain a dial-in link for a vulnerable server and then initiates a series of calls within a short amount of time. The update addresses the vulnerability by correcting the way that Skype for Business server handles objects in memory.

Affected products

• Microsoft Lync Server: 2010, 2013
• Microsoft Lync Server 2010: before publication — fixed in publication
• Microsoft Lync Server 2013: before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft Lync Server 2010 publication; Microsoft Lync Server 2013 publication. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1029
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1029

Get alerted when CVE-2019-1029 or the next vulnerability affects your stack