CVE-2019-19694

Vulnerability

Trend Micro Security 2019 (version 15.0.0.1163 and earlier) consumer products—Premium Security, Maximum Security, Internet Security, and Antivirus+ Security for Windows—contain a denial-of-service vulnerability (CWE-400) [1][2]. An attacker can manipulate a key file during system startup to disable malware protection or the entire product.

Exploitation

An attacker requires local access to manipulate the key file at a specific time during startup [1][2]. No authentication or user interaction is needed beyond file write access at that moment.

Impact

Successful exploitation disables Trend Micro's malware protection functions or completely disables the product, leaving the system vulnerable to malware [1][2].

Mitigation

Update to Trend Micro Security 2020 (version 16) or later, which are not affected [1][2]. Users on outdated, unsupported versions should upgrade to a supported version [1][2].