CVE-2017-0005KEV · OVERDUE

Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability

High · published March 17, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 95.9th percentile for exploit probability.

1592
days past CISA
deadline
CVSS v3.1
7.8
EPSS
11%
Percentile
95.9
In the wild
Confirmed
What it is

🚨 A crafty app is all it takes to boost your privileges! The Windows Graphics Device Interface (GDI) has a sneaky flaw that local users can exploit to gain elevated rights. 🔥 Think of it as a hotel with a faulty keycard system—if a guest can convince the front desk to reissue a key, they could waltz into any room, including the fancy penthouse suites. 🏨 This vulnerability is a playground for local attackers; they could gain unauthorized access to sensitive system functions and data, potentially wreaking havoc on your machine. Imagine someone getting into the admin suite and changing the locks or even deleting files—absolutely devastating!

Put simply

Think of it as a hotel with a faulty keycard system—if a guest can convince the front desk to reissue a key, they could waltz into any room, including the fancy penthouse suites. 🏨 The GDI elevation of privilege vulnerability allows local users to run crafted applications that manipulate system functions, leading to unauthorized access and control over system resources.

What to do

This vulnerability is a playground for local attackers; they could gain unauthorized access to sensitive system functions and data, potentially wreaking havoc on your machine. Imagine someone getting into the admin suite and changing the locks or even deleting files—absolutely devastating! To shield your systems, ensure you patch to the latest version of Windows—specifically install updates that address this vulnerability. Regularly review user permissions to limit access to sensitive functions. 🛡️ You’ve got this! With the right steps, you'll keep your system safe and sound! 🚀

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.11022 · 95.9th percentile
Published
2017-03-17T00:00Z
KEV added
2022-05-24 · due 2022-06-14
EPSS history
Timeline
  • 24 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 14
    kev
  • 17 MAR 00:00Z
    The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold…
    cvelistv5