CVE-2016-3393: Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability
Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."
Other sources
A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.
— CISA
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3393?
CVE-2016-3393 has a critical severity rating that allows remote attackers to execute arbitrary code.
How do I fix CVE-2016-3393?
To fix CVE-2016-3393, you should apply the latest security updates provided by Microsoft for your affected Windows version.
What versions of Windows are affected by CVE-2016-3393?
CVE-2016-3393 affects multiple versions, including Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows 10, and various Windows Server editions.
Can CVE-2016-3393 be exploited remotely?
Yes, CVE-2016-3393 can be exploited remotely without user interaction, making it particularly dangerous.
What component of Windows does CVE-2016-3393 affect?
CVE-2016-3393 affects the Graphics Device Interface (GDI) of Microsoft Windows.