Windows COM Marshaler CVE-2017-0213

Apply Microsoft's May 2017 security updates immediately via the platform-specific patches listed in security advisory CVE-2017-0213 at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213. For Windows 7 and Server 2008 R2 systems now past end-of-life, organizations must either purchase Extended Security Updates (ESU) from Microsoft to receive the patch, migrate to supported Windows versions (Windows 10/11, Server 2016 or later), or implement compensating controls with significant operational impact. Compensating controls for unpatchable systems include: restricting local logon rights to only essential administrative accounts via Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > 'Allow log on locally'), which prevents low-privileged users from executing local exploits but severely limits workstation usability; deploying application whitelisting via Windows AppLocker or third-party solutions to block unauthorized executables, though this requires extensive baseline development and ongoing maintenance; and network segmentation to isolate vulnerable systems from internet-facing assets, reducing initial access vectors but not eliminating risk from insider threats or lateral movement. None of these mitigations fully address the vulnerability - patching or replacement remains the only complete solution. Organizations maintaining legacy systems should implement multiple compensating controls in defense-in-depth layers while accelerating migration timelines given confirmed active exploitation.