CVE-2019-1012

CVE-2019-1012 is an information disclosure vulnerability in the Windows GDI component, affecting various versions of Microsoft Windows and Windows Server. It allows an attacker to obtain sensitive memory contents, potentially aiding further system compromise. The vulnerability has a CVSS score of 4.7 (Medium), indicating a low-privilege, high-complexity attack that requires user interaction (e.g., opening a malicious document or visiting a crafted webpage) to achieve high confidentiality impact. While no public exploits or Metasploit modules are available, and it's not listed in CISA's KEV catalog, the vulnerability has received some community discussion and media coverage, suggesting awareness within the cybersecurity community. Microsoft addressed this flaw by correcting how GDI handles memory objects.