High severity7.0NVD Advisory· Published Feb 18, 2019· Updated Jun 17, 2026

CVE-2019-8372

Description

The LHA.sys driver before 1.1.1811.2101 in LG Device Manager exposes functionality that allows low-privileged users to read and write arbitrary physical memory via specially crafted IOCTL requests and elevate system privileges. This occurs because the device object has an associated symbolic link and an open DACL.

Affected products

LG/Lha.sys
cpe:2.3:a:lg:lha.sys:*:*:*:*:*:*:*:*
Range: <1.1.1811.2101
LG/Device Managerllm-create
Range: <1.1.1811.2101
LG/LHA.sys driverllm-create
Range: <1.1.1811.2101

Patches

Vulnerability mechanics

References

www.jackson-t.ca/lg-driver-lpe.htmlnvdExploitThird Party Advisory
lgsecurity.lge.com/security_updates.htmlnvdVendor Advisory
twitter.com/Jackson_T/status/1097353402034475009nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000