{"schemaVersion":3,"id":"CVE-2016-3393","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability","description":"Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Windows Graphics Component RCE Vulnerability.\"","dates":{"published":"2016-10-14T01:00:00.000Z","modified":"2025-10-21T23:55:49.334Z","reserved":null,"kevAdded":["2022-05-25T00:00:00.000Z"],"kevDue":["2022-06-15T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.68465,"percentile":0.99332,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.68465},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.68684,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.68684,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.68684,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.68465,"percentile":0.99332}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.68465,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.68465,"percentile":0.99332}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-25T00:00:00.000Z","dueDate":"2022-06-15T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2016-3393","label":"nvd.nist.gov/vuln/detail/CVE-2016-3393"}],"vendor":"Microsoft","product":"Windows","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-25T00:00:00.000Z","dueDate":"2022-06-15T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability","description":"A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2016-3393","label":"nvd.nist.gov/vuln/detail/CVE-2016-3393"}],"vendor":"Microsoft","product":"Windows","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"microsoft","product":"windows_10_1507","name":"windows 10 1507","label":"windows_10_1507","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_10_1507"},{"vendor":"microsoft","product":"windows_10_1511","name":"windows 10 1511","label":"windows_10_1511","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_10_1511"},{"vendor":"microsoft","product":"windows_10_1607","name":"windows 10 1607","label":"windows_10_1607","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_10_1607"},{"vendor":"microsoft","product":"windows_7","name":"windows 7","label":"windows_7","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_7"},{"vendor":"microsoft","product":"windows_8.1","name":"windows 8.1","label":"windows_8.1","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_81"},{"vendor":"microsoft","product":"windows_rt_8.1","name":"windows rt 8.1","label":"windows_rt_8.1","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_rt_81"},{"vendor":"microsoft","product":"windows_server_2008","name":"windows server 2008","label":"windows_server_2008","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"r2:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | r2:sp1","eol":null,"hubHref":"/vendor/microsoft/windows_server_2008"},{"vendor":"microsoft","product":"windows_server_2012","name":"windows server 2012","label":"windows_server_2012","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | r2","eol":null,"hubHref":"/vendor/microsoft/windows_server_2012"},{"vendor":"microsoft","product":"windows_vista","name":"windows vista","label":"windows_vista","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_vista"}],"affectedCount":9,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id/1036988","label":"www.securitytracker.com/id/1036988","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/93377","label":"www.securityfocus.com/bid/93377","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS","Patch"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3393","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3393","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2016-10-14T01:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-05-25T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-15T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:55:49.334Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T23:17:53.503Z","stale":false,"partial":false}}