{"schemaVersion":3,"id":"CVE-2017-8683","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an attacker to execute remote code by the way it handles embedded fonts, aka \"Win32k Graphics Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-8682.","dates":{"published":"2017-09-13T01:00:00.000Z","modified":"2024-09-16T19:56:40.778Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.5,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":2.1,"severity":"low","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.22553,"percentile":0.97709,"severity":"high","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":-4.973,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.27526},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.27526,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.22553,"percentile":0.97709}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.27526,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.22553,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.22553,"percentile":0.97709}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"42746","name":"Microsoft Windows Kernel - 'win32k.sys' '.TTF' Font Processing Out-of-Bounds Read with Malformed 'glyf' Table 'win32k!fsc_CalcGrayRow' (Denial of Service)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/42746","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":"dos","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"dos","platform":"windows","file":"exploits/windows/dos/42746.txt","codes":["CVE-2017-8683"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"}],"affected":[{"vendor":"microsoft corporation","product":"windows graphics","name":"Windows graphics","label":"windows graphics","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016","eol":null,"hubHref":"/vendor/microsoft_corporation/windows_graphics"},{"vendor":"microsoft","product":"windows_10","name":"windows 10","label":"windows_10","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"1511","noFixRecorded":false,"fixedIn":null},{"text":"1607","noFixRecorded":false,"fixedIn":null},{"text":"1703","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | 1511 | 1607 | 1703","eol":null,"hubHref":"/vendor/microsoft/windows_10"},{"vendor":"microsoft","product":"windows_7","name":"windows 7","label":"windows_7","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_7"},{"vendor":"microsoft","product":"windows_8.1","name":"windows 8.1","label":"windows_8.1","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_81"},{"vendor":"microsoft","product":"windows_server_2008","name":"windows server 2008","label":"windows_server_2008","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"r2:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | r2:sp1","eol":null,"hubHref":"/vendor/microsoft/windows_server_2008"},{"vendor":"microsoft","product":"windows server 2012","name":"Windows Server 2012","label":"windows server 2012","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | r2","eol":null,"hubHref":"/vendor/microsoft/windows_server_2012"},{"vendor":"microsoft","product":"windows server 2016","name":"Windows Server 2016","label":"windows server 2016","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/windows_server_2016"}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.exploit-db.com/exploits/42746/","label":"www.exploit-db.com/exploits/42746/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039338","label":"www.securitytracker.com/id/1039338","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8683","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8683","hostname":"portal.msrc.microsoft.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/100781","label":"www.securityfocus.com/bid/100781","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-09-13T01:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T19:56:40.778Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":37,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T14:50:05.292Z","stale":false,"partial":false}}