CVE-2019-19705

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-26 · updated 2026-06-17
Weakness: CWE-428

Description

Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (and on many other Lenovo and non-Lenovo products), mishandles DLL preloading.

Affected products

Lenovo Aio300-23Isu Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio310-20Iap Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio510-22Ish Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio510-23Ish Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio520-22Ikl Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio520-22Iku Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio520-24Ikl Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio520-24Iku Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio520-27Ikl Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio720-24Ikb Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Aio 910-27Ish Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Aio Y910-27Ish Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Ideacentre 300S-11Ish Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 310-15Asr Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 310-15Iap Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 310A-15Iap Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 310S-08Iap Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 510-15Abr Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 510-15Ikl Firmware: before 6.0.8923.1 — fixed in 6.0.8923.1
Lenovo Ideacentre 510S-08Ikl Firmware: before 6.0.8923.1 — fixed in 6.0.8923.1
Lenovo Ideacentre 510S-08Ish Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 520S-23Iku Firmware: before 6.0.8881.1 — fixed in 6.0.8881.1
Lenovo Ideacentre 610S-02Ish Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 620S-03Ikl Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 700 Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Ideacentre 720-18Asr Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Legion Y520T Z370 Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Legion Y720 Tower Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Legion Y720T Amd Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1
Lenovo Legion Y920 Tower Firmware: before 6.0.8924.1 — fixed in 6.0.8924.1

How to fix

Upgrade to a fixed version: Lenovo Aio300-23Isu Firmware 6.0.8881.1; Lenovo Aio310-20Iap Firmware 6.0.8881.1; Lenovo Aio510-22Ish Firmware 6.0.8881.1; Lenovo Aio510-23Ish Firmware 6.0.8881.1; Lenovo Aio520-22Ikl Firmware 6.0.8881.1; Lenovo Aio520-22Iku Firmware 6.0.8881.1; Lenovo Aio520-24Ikl Firmware 6.0.8881.1; Lenovo Aio520-24Iku Firmware 6.0.8881.1; Lenovo Aio520-27Ikl Firmware 6.0.8881.1; Lenovo Aio720-24Ikb Firmware 6.0.8881.1; Lenovo Aio 910-27Ish Firmware 6.0.8924.1; Lenovo Aio Y910-27Ish Firmware 6.0.8881.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-19705 or the next vulnerability affects your stack