Read the docs
TI-2019-01477 Aliases CVE-2019-1855GHSA-m3pw-gwv9-w25w

Cisco Jabber for Windows DLL Preloading Vulnerability

Priority LOW 38CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-264 and CWE-427.

Summary

A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform a DLL preloading attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the Jabber application launches. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user's account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0226 83rd percentileScored 2026-11-07
Fix Fixed Cisco Jabber for Windows (Cisco): 12.6(0)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Jabber for Windowsbefore 12.6(0)12.6(0)Patch availableCNA
  • Cisco Jabber for Windows VendorCisco Affected before 12.6(0) Fixed in 12.6(0) Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*before 12.6\(2\)VulnerableCisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:* Versions before 12.6\(2\) Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco Jabber for Windows (Cisco) Fixed in 12.6(0)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1855
  2. 2026-10-03 Alias added: GHSA-m3pw-gwv9-w25w

References

Advisory 1

  • TI-2020-03041 Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2020-15937 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2020-02979 Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-01198 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2021-01138 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2020-16496 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences