Vulnerability record · CVE-2011-5046 · published 30 December 2011
CVE-2011-5046: Windows win32k.sys GDI input validation flaw allows remote code execution
Microsoft · Windows 7
The Graphics Device Interface in win32k.sys fails to properly validate user-mode input, allowing memory corruption when crafted data is processed. A large height attribute on an IFRAME element rendered by Safari is cited as a demonstration, and successful exploitation can lead to arbitrary code execution in kernel mode.
Description
The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted data, as demonstrated by a large height attribute of an IFRAME element rendered by Safari, aka "GDI Access Violation Vulnerability."
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityCVSS 2.0 score of 9.3 with network reachability and public exploit code, though exploitation requires user interaction and the flaw is long patched.
What it is
The Graphics Device Interface in win32k.sys fails to properly validate user-mode input, allowing memory corruption when crafted data is processed. A large height attribute on an IFRAME element rendered by Safari is cited as a demonstration, and successful exploitation can lead to arbitrary code execution in kernel mode.
Impact
An attacker can execute arbitrary code with kernel privileges or crash the system, giving full control of the affected host.
Attack surface
The vulnerability is reachable remotely over the network (AV:N) with no authentication required, but exploitation requires medium complexity and some form of user interaction such as rendering crafted content.
Exploitation
An Exploit-DB entry is referenced, indicating public exploit code exists, but the CVE is not listed in CISA KEV and no ransomware usage is documented. EPSS shows a high 30-day probability of 0.453 (98.7th percentile).
What to do
- Apply Microsoft security bulletin MS12-008, which addresses this GDI access violation.
- Upgrade or retire affected platforms (Windows XP, Server 2003, Vista, Server 2008, Windows 7) that are past end of support.
- Restrict or disable unnecessary rendering of untrusted web content in Safari and other browsers on affected systems.
- Enforce least privilege and application allowlisting to limit the impact of successful code execution.
Detection
- Monitor for unexpected win32k.sys crashes or GDI-related memory corruption events in system logs.
- Hunt for processes spawning from browser or rendering engines with unusual child processes or kernel-level activity.
- Track Exploit-DB and vendor advisories for exploit code matching this GDI access violation and correlate with endpoint telemetry.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-5046 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-5046), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
