Read the docs
TI-2019-02688 Aliases CVE-2019-3648GHSA-jg35-9g6q-f79j

Implicit loading of DLLs

Priority LOW 31CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier allows administrators to execute arbitrary code via carefully placing malicious files in specific locations protected by administrator permission.

Why it matters now

EPSS 0.00661 51st percentileScored 2026-11-07
Fix Fixed McAfee Total Protection (McAfee,LLC): 16.0.R22 Refresh 1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Total Protection16.0.x to before 16.0.R22 Refresh 116.0.R22 Refresh 1Patch availableCNA
  • McAfee Total Protection VendorMcAfee Affected 16.0.x to before 16.0.R22 Refresh 1 Fixed in 16.0.R22 Refresh 1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:anti-virus_plus:*:*:*:*:*:*:*:*up to 16.0.r22VulnerableMcAfee
cpe:2.3:a:mcafee:internet_security:*:*:*:*:*:*:*:*up to 16.0.r22VulnerableMcAfee
cpe:2.3:a:mcafee:total_protection:*:*:*:*:*:*:*:*up to 16.0r22VulnerableMcAfee
  • cpe:2.3:a:mcafee:anti-virus_plus:*:*:*:*:*:*:*:* Versions up to 16.0.r22 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:internet_security:*:*:*:*:*:*:*:* Versions up to 16.0.r22 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:total_protection:*:*:*:*:*:*:*:* Versions up to 16.0r22 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Total Protection (McAfee,LLC) Fixed in 16.0.R22 Refresh 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3648
  2. 2026-10-03 Alias added: GHSA-jg35-9g6q-f79j
  3. 2026-10-07 EPSS moved to the 50th–90th percentile

References

Other 2

  • TI-2017-03022 SB10193 - consumer and corporate products - Maliciously misconfigured registry vulnerability CVSS 3.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences