What’s Vulnerable › Vulnerabilities

CVE-2019-1099

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-29 · updated 2026-06-17
• Weakness: CWE-200

Description

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1095, CVE-2019-1098, CVE-2019-1100, CVE-2019-1101, CVE-2019-1116.

Affected products

• Microsoft Windows 7: all versions
• Microsoft Windows Server 2008: r2-sp1
• Microsoft Corporation Windows: 7 for 32-bit Systems Service Pack 1, 7 for x64-based Systems Service Pack 1
• Microsoft Windows Server: 2008 R2 for x64-based Systems Service Pack 1 (Core installation), 2008 R2 for Itanium-Based Systems Service Pack 1, 2008 R2 for x64-based Systems Service Pack 1, 2008 for 32-bit Systems Service Pack 2 (Core installation), 2008 for Itanium-Based Systems Service Pack 2, 2008 for 32-bit Systems Service Pack 2 (+2)

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1099
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1099

Get alerted when CVE-2019-1099 or the next vulnerability affects your stack