Read the docs
TI-2019-00504 Aliases CVE-2019-0727GHSA-4vgf-c8vc-m3fj

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard…

Priority LOW 36Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Diagnostic Hub Standard Collector, Visual Studio Standard Collector Elevation of Privilege Vulnerability'.

Why it matters now

EPSS 0.01049 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Visual Studio2015 Update 3—No fix listedCNA
MicrosoftWindows10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 10 Version 1703 for 32-bit Systems; 10 Version 1703 for x64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for ARM64-based Systems—No fix listedCNA
MicrosoftWindows Server2016; 2016 (Core installation); version 1803 (Core Installation); 2019; 2019 (Core installation)—No fix listedCNA
MicrosoftMicrosoft Visual Studio 2017version 15.9; 15.0—No fix listedCNA
MicrosoftWindows 10 Version 1903 for 32-bit Systemsall versions—No fix listedCNA
MicrosoftWindows 10 Version 1903 for x64-based Systemsall versions—No fix listedCNA
MicrosoftWindows 10 Version 1903 for ARM64-based Systemsall versions—No fix listedCNA
MicrosoftWindows Server, version 1903 (Server Core installation)all versions—No fix listedCNA
MicrosoftMicrosoft Visual Studio 201916.0—No fix listedCNA
  • Microsoft Visual Studio VendorMicrosoft Affected 2015 Update 3 Fixed in — No fix listed CNA
  • Windows VendorMicrosoft Affected 10 for 32-bit Systems; 10 for x64-based Systems; 10 Version 1607 for 32-bit Systems; 10 Version 1607 for x64-based Systems; 10 Version 1703 for 32-bit Systems; 10 Version 1703 for x64-based Systems; 10 Version 1709 for 32-bit Systems; 10 Version 1709 for x64-based Systems; 10 Version 1803 for 32-bit Systems; 10 Version 1803 for x64-based Systems; 10 Version 1803 for ARM64-based Systems; 10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems; 10 Version 1709 for ARM64-based Systems Fixed in — No fix listed CNA
  • Windows Server VendorMicrosoft Affected 2016; 2016 (Core installation); version 1803 (Core Installation); 2019; 2019 (Core installation) Fixed in — No fix listed CNA
  • Microsoft Visual Studio 2017 VendorMicrosoft Affected version 15.9; 15.0 Fixed in — No fix listed CNA
  • Windows 10 Version 1903 for 32-bit Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Windows 10 Version 1903 for x64-based Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Windows 10 Version 1903 for ARM64-based Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Windows Server, version 1903 (Server Core installation) VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Visual Studio 2019 VendorMicrosoft Affected 16.0 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:visual_studio:2015:update3:*:*:*:*:*:*2015 update3VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2017:15.0:*:*:*:*:*:*:*15.0VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:*15.9VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:*16.0VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*1607VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*1703VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*1709VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*1803VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*1809VulnerableMicrosoft
  • cpe:2.3:a:microsoft:visual_studio:2015:update3:*:*:*:*:*:* Versions 2015 update3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2017:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:* Versions 15.9 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2019:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* Versions 1803 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Vulnerable ·Microsoft
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*1903VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*1803VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*1903VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:* Versions 1903 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:* Versions 1803 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:* Versions 1903 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0727
  2. 2026-10-03 Alias added: GHSA-4vgf-c8vc-m3fj

References

Patch 1

  • TI-2022-16266 Visual Studio Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2008-03546 Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69… CVSS 2.0HIGH 9.3
  • TI-2009-02381 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio… CVSS 3.1HIGH 8.8
  • TI-2009-00858 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio… CVSS 3.1HIGH 8.8
  • TI-2009-02389 Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2… CVSS 2.0HIGH 9.3
  • TI-2009-02388 Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3… CVSS 2.0HIGH 9.3
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences