{"id":"CVE-2019-19364","aliases":["EUVD-2019-8985","GHSA-xxr3-85vr-f7wf"],"status":"published","title":"In Sony Catalyst Production Suite through 2019.1 (1.1.0.21) and Catalyst Browse through 2019.1 (1...","description":"A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1.0.21) installers run. The vulnerability is in the form of DLL Hijacking. The installers try to load DLLs that don’t exist from its current directory; by doing so, an attacker can quickly escalate its privileges.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00471,"percentile":0.41036,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-426","CWE-427"],"published":"2019-12-04T18:42:20Z","modified":"2026-06-17T02:26:34Z","products":[{"vendor":"sony","product":"catalyst_browse"},{"vendor":"sony","product":"catalyst_production_suite"}],"references":[{"url":"https://gist.github.com/Eli-Paz/482b514320009f3e76ea712cde3bc350","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19364"},{"url":"https://github.com/advisories/GHSA-xxr3-85vr-f7wf"}],"sources":{"cve":[{"id":"CVE-2019-19364","description":"A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1.0.21) installers run. The vulnerability is in the form of DLL Hijacking. The installers try to load DLLs that don’t exist from its current directory; by doing so, an attacker can quickly escalate its privileges.","status":"published","published":"2019-12-04T18:42:20Z","modified":"2024-08-05T02:16:47.062Z","updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-8985","description":"A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1.0.21) installers run. The vulnerability is in the form of DLL Hijacking. The installers try to load DLLs that don’t exist from its current directory; by doing so, an attacker can quickly escalate its privileges.","status":"published","published":"2019-12-04T18:42:20Z","modified":"2024-08-05T02:16:47Z","updated_at":"2026-11-03T02:40:25.391321Z"}],"ghsa":[{"id":"GHSA-xxr3-85vr-f7wf","title":"In Sony Catalyst Production Suite through 2019.1 (1.1.0.21) and Catalyst Browse through 2019.1 (1...","description":"In Sony Catalyst Production Suite through 2019.1 (1.1.0.21) and Catalyst Browse through 2019.1 (1.1.0.21), an unprivileged user can obtain admin privileges, and execute a program as admin, after DLL hijacking of a DLL that is loaded during setup (installation).","status":"published","published":"2022-05-24T17:02:41Z","modified":"2023-01-28T05:08:31Z","cwes":["CWE-426","CWE-427"],"updated_at":"2026-11-02T14:44:37.39101Z"}],"nvd":[{"id":"CVE-2019-19364","description":"A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1.0.21) installers run. The vulnerability is in the form of DLL Hijacking. The installers try to load DLLs that don’t exist from its current directory; by doing so, an attacker can quickly escalate its privileges.","status":"published","published":"2019-12-04T19:15:11.94Z","modified":"2026-06-17T02:26:34.127Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:05:38.993437Z"}]}}