CVE-2017-0038

MEDIUM

Microsoft Windows 10 - Information Disclosure

Title source: rule

Description

gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, as demonstrated by an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap (DIB) dimensions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.

Exploits (2)

nomisec WORKING POC 6 stars
by k0keoyo · poc
https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS
exploitdb WRITEUP VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/41363

References (7)

Scores

CVSS v3 5.5
EPSS 0.8046
EPSS Percentile 99.1%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Classification

CWE
CWE-200
Status published

Affected Products (13)

microsoft/windows_10
microsoft/windows_10
microsoft/windows_10
microsoft/windows_7
microsoft/windows_8.1
microsoft/windows_rt_8.1
microsoft/windows_server_2008
microsoft/windows_server_2008
microsoft/windows_server_2012
microsoft/windows_server_2012
microsoft/windows_server_2016
microsoft/windows_vista
Microsoft Corporation/Windows Graphics Component < The Graphics Device Interface (GDI) component in Microsoft Windows Vista SP2; Windows Server 2008 SP

Timeline

Published Feb 20, 2017
Tracked Since Feb 18, 2026