Windows Win32k CVE-2017-0263

Apply Microsoft's May 2017 security updates immediately via Windows Update or WSUS, as detailed in advisory https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0263. Specific patch KB numbers vary by Windows version but were released as part of the May 2017 Patch Tuesday cumulative updates. For systems that cannot be immediately patched, implement compensating controls: restrict local logon rights to trusted administrators only via Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > 'Allow log on locally'), disable unnecessary local user accounts, implement application whitelisting via AppLocker or Windows Defender Application Control to prevent execution of unauthorized local binaries, and monitor for suspicious privilege escalation attempts via Sysmon Event ID 10 (process access) and Security Event ID 4672 (special privileges assigned to new logon). Note that these mitigations only reduce attack surface - they do not eliminate the vulnerability and will impact legitimate local user workflows. Prioritize patching over workarounds given confirmed active exploitation.