{"id":"CVE-2017-0038","published":"2017-02-20T16:00:00Z","modified":"2024-08-05T12:47:57Z","title":"gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1…","vendor":"Microsoft Corporation","product":"Windows Graphics Component","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft Corporation","product":"Windows Graphics Component","versions":["The Graphics Device Interface (GDI) component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607"]}],"description":{"text":"gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, as demonstrated by an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap (DIB) dimensions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an information disclosure issue in gdi32.dll, the Graphics Device Interface component of Microsoft's Windows Graphics Component, affecting multiple Windows releases. It stems from an incomplete fix for earlier GDI vulnerabilities. A remote attacker can read sensitive data from process heap memory by supplying a crafted EMF file, for example one containing an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap dimensions.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:19:22Z"},"cvss":null,"epss":{"score":0.82226,"percentile":0.99655,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=992","tags":["x_refsource_MISC"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0038","tags":["x_refsource_CONFIRM"]},{"url":"https://0patch.blogspot.com/2017/02/0patching-0-day-windows-gdi32dll-memory.html","tags":["x_refsource_MISC"]},{"url":"http://www.securitytracker.com/id/1037845","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securityfocus.com/bid/96023","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/41363/","tags":["exploit","x_refsource_EXPLOIT-DB"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-0405","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0405","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":41363,"url":"https://www.exploit-db.com/exploits/41363","title":"Microsoft Windows - 'gdi32.dll' EMR_SETDIBITSTODEVICE Heap Out-of-Bounds Reads / Memory Disclosure","type":"dos","platform":"windows","date":"2017-02-15","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2017-02-15"},"pocGithub":{"count":1,"skipped":0,"earliest":"2017-03-22","earliestUrl":"https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS","repos":[{"name":"k0keoyo/CVE-2017-0038-EXP-C-JS","url":"https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS","stars":6,"created":"2017-03-22"}]},"first":{"date":"2017-02-15","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/41363"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/41363/"],"flow":[],"timeline":[{"date":"2017-02-15","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-41363); later: PoC-in-GitHub 2017-03-22","url":"https://www.exploit-db.com/exploits/41363","provenance":"source"},{"date":"2017-02-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-0038","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9966"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-microsoft-corporation-windows-graphics-c-cve-2016-3216","parents":[{"from":"CVE-2016-3216","to":"CVE-2017-0038","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.","from":"CVE.org","in":"CVE-2017-0038"}]},{"from":"CVE-2016-3219","to":"CVE-2017-0038","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.","from":"CVE.org","in":"CVE-2017-0038"}]},{"from":"CVE-2016-3220","to":"CVE-2017-0038","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.","from":"CVE.org","in":"CVE-2017-0038"}]}]}}