⚠ Actively exploited
Added to CISA KEV on 2022-05-25. Federal agencies required to patch by 2022-06-15. Required action: Apply updates per vendor instructions..

CVE-2016-3393 — Improper Access Control in Microsoft Windows Server 2008

CWE-284 — Improper Access Control11 documents7 sources
Severity
7.8HIGHNVD
EPSS
53.1%
top 2.03%
CISA KEV
KEV
Added 2022-05-25
Due 2022-06-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
14
Microsoft Windows Server 2008Microsoft Windows Server 2012Msrc Windows 10+11 more
Timeline
PublishedOct 14
KEV addedMay 25
KEV dueJun 15
CISA Required Action: Apply updates per vendor instructions.

Description

Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages13 packages

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9xwj-cq6w-69v3: Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8↗2022-05-14
▶
VulnCheck
Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability↗2016
▶

📋Vendor Advisories

2
CISA
Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability↗2022-05-25
▶
Microsoft
GDI+ Remote Code Execution Vulnerability↗2016-10-11
▶

🕵️Threat Intelligence

6
Securelist
Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016↗2016-12-14
▶
Securelist
Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016↗2016-12-14
▶
Securelist
Windows zero-day exploit used in targeted attacks by FruityArmor APT↗2016-10-20
▶
Securelist
Windows zero-day exploit used in targeted attacks by FruityArmor APT↗2016-10-20
▶
Talos
Microsoft Patch Tuesday - October 2016↗2016-10-11
▶