How to fix CVE-2017-0005?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Vendor patch is available.

Is Windows affected by CVE-2017-0005?

CVE-2017-0005 presents notable security risk rated CVSS 7.8. Exploitation could compromise the security of affected deployments. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation.

CVE-2017-0005

HIGH

2017-03-17 [email protected]

7.8

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 11:18 vuln.today

Added to CISA KEV

Oct 22, 2025 - 00:15 cisa

CISA KEV

PoC Detected

Oct 22, 2025 - 00:15 vuln.today

Public exploit code

Patch Released

Oct 22, 2025 - 00:15 nvd

Patch available

CVE Published

Mar 17, 2017 - 00:59 nvd

HIGH 7.8

Description

The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047.

Analysis

Windows GDI (Graphics Device Interface) allows local privilege escalation through improper memory handling, attributed to the Zirconium APT group and exploited alongside browser zero-days in targeted campaigns.

Technical Context

The vulnerability in the Windows GDI subsystem allows local code to escalate privileges through improper handling of GDI objects in memory. Exploitation involves creating specially crafted GDI operations that trigger kernel-mode memory corruption.

Affected Products

['Microsoft Windows Vista SP2 through Windows 10 1607', 'Microsoft Windows Server 2008 SP2 through Server 2016', 'Microsoft Windows RT 8.1']

Remediation

Apply Microsoft security update MS17-013. Deploy Windows Defender Exploit Guard with Attack Surface Reduction rules.

Priority Score

Low Medium High Critical

KEV: +50

EPSS: +8.0

CVSS: +39

POC: +20

CVE-2017-0005 vulnerability details – vuln.today

Back

CVE-2017-0005

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2017-0005

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code