{"uuid": "7a9d909d-ed05-4094-873e-2417d91e289e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-0808", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ntusermndragover.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86\", \"author\": [\"Cl\\u00e9ment Lecigne\", \"Grant Willcox\", \"timwr\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a NULL pointer dereference vulnerability in\\n          MNGetpItemFromIndex(), which is reachable via a NtUserMNDragOver() system call.\\n\\n          The NULL pointer dereference occurs because the xxxMNFindWindowFromPoint()\\n          function does not effectively check the validity of the tagPOPUPMENU\\n          objects it processes before passing them on to MNGetpItemFromIndex(),\\n          where the NULL pointer dereference will occur.\\n\\n          This module has been tested against Windows 7 x86 SP0 and SP1. Offsets\\n          within the solution may need to be adjusted to work with other versions\\n          of Windows, such as Windows Server 2008.\", \"disclosure_date\": \"2019-03-12\", \"fullname\": \"exploit/windows/local/ntusermndragover\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:46 +0000\", \"name\": \"Microsoft Windows NtUserMNDragOver Local Privilege Elevation\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"screen-effects\"], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/exploits/windows/local/ntusermndragover.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/local/ntusermndragover\", \"references\": [\"CVE-2019-0808\", \"URL-https://github.com/exodusintel/CVE-2019-0808\", \"URL-https://github.com/ze0r/cve-2019-0808-poc\", \"URL-http://blogs.360.cn/post/RootCause_CVE-2019-0808_EN.html\", \"URL-https://blog.exodusintel.com/2019/05/17/windows-within-windows/\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Windows 7 x86\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:12.412008Z"}