CVE-2019-1029: microsoft lync_server
Vulnerability summary
CVE-2019-1029 is a high (CVSS 7.1) vulnerability in microsoft lync_server. EPSS estimates a 5.28% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities.
Timeline
- 12-06-2019PublishedVulnerability first disclosed.
- 20-05-2025Last modifiedVulnerability information updated.
Description
A denial of service vulnerability exists in Skype for Business. An attacker who successfully exploited the vulnerability could cause Skype for Business to stop responding. Note that the denial of service would not allow an attacker to execute code or to elevate the attacker's user rights. To exploit the vulnerability, an attacker needs to obtain a dial-in link for a vulnerable server and then initiates a series of calls within a short amount of time. The update addresses the vulnerability by correcting the way that Skype for Business server handles objects in memory.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
5.28%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 5.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft3 products
- lync_server2010 | 2013
- microsoft lync server 2010< publication
- microsoft lync server 2013< publication
1 vendor · 3 products
References
2 links
msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1029Vendor Advisory- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1029X Refsource MISCX TransferredPatchVendor Advisory