CVE-2019-0985
Published: Jun 12, 2019
Modified: May 20, 2025
CVSS v3.1
7.8
Description
A remote code execution vulnerability exists when the Microsoft Speech API (SAPI) improperly handles text-to-speech (TTS) input. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. To exploit the vulnerability, an attacker would need to convince a user to open a specially crafted document containing TTS content invoked through a scripting language. The update address the vulnerability by modifying how the system handles objects in memory.
| Vendor | Product | Versions |
|---|---|---|
Microsoft | Windows 7 | affected 6.1.0 - < publication |
Microsoft | Windows 7 Service Pack 1 | affected 6.1.0 - < publication |
Microsoft | Windows Server 2008 R2 Systems Service Pack 1 | affected 6.1.0 - < publication |
Microsoft | Windows Server 2008 R2 Service Pack 1 | affected 6.1.7601.0 - < publication |
Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) | affected 6.1.7601.0 - < publication |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now