CVE-2017-0001: Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability

Vulnerability summary

CVE-2017-0001 is a high (CVSS 7.8) vulnerability in Microsoft Graphics Device Interface (GDI). It is known to be exploited: CISA lists it, first on 03-03-2022. EPSS estimates a 3.11% chance of exploitation in the next 30 days, higher than 87.6% of scored vulnerabilities.

Timeline

1. 17-03-2017
   PublishedVulnerability first disclosed.
2. 03-03-2022
   Added to CISA KEVMicrosoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability
3. 24-03-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0005, CVE-2017-0025, and CVE-2017-0047.

No weakness data has been published for this record.