Vulnerability record · CVE-2016-3393 · published 14 October 2016
CVE-2016-3393: Windows GDI remote code execution via crafted website
Microsoft · Windows 10 1507
The Windows Graphics Device Interface (GDI/GDI+) fails to properly handle objects, allowing remote code execution when a user views a crafted web page. The flaw affects a broad set of Windows client and server releases, and successful exploitation gives the attacker the same rights as the logged-on user.
Description
Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw allows remote code execution, is listed in CISA KEV with a very high EPSS score, and affects a wide range of Windows versions.
What it is
The Windows Graphics Device Interface (GDI/GDI+) fails to properly handle objects, allowing remote code execution when a user views a crafted web page. The flaw affects a broad set of Windows client and server releases, and successful exploitation gives the attacker the same rights as the logged-on user.
Impact
An attacker can execute arbitrary code in the context of the current user, leading to full compromise of confidentiality, integrity and availability on the affected host.
Attack surface
Reached through a crafted website rendered by the affected graphics component; the CVSS vector indicates local access with user interaction required (UI:R) and no privileges required (PR:N), so a victim must be lured into viewing the page.
Exploitation
CVE-2016-3393 is listed in CISA KEV (added 2022-05-25) and has a high EPSS 30-day probability of 0.687 (99.3rd percentile), indicating observed exploitation activity; no ransomware campaign use is documented.
What to do
- Apply the Microsoft MS16-120 security update to all affected Windows versions immediately.
- Prioritize patching internet-facing and user-workstation systems running the affected Windows releases.
- Enforce browser and email protections that block untrusted content and reduce drive-by exposure.
- Retire or isolate end-of-support platforms such as Vista, Windows 7 and Windows 8.1 where feasible.
Detection
- Monitor for unexpected child processes spawned by browser or graphics-related processes.
- Alert on crashes or anomalous behavior in GDI/GDI+ related components.
- Hunt for known exploitation artifacts tied to CVE-2016-3393 using available threat intelligence.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2016-3393 to the Known Exploited Vulnerabilities catalog on 25 May 2022 as "Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 June 2022.
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/93377 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1036988 | Broken LinkThird Party AdvisoryVDB Entry |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120 | PatchVendor Advisory |
| http://www.securityfocus.com/bid/93377 | Broken LinkThird Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1036988 | Broken LinkThird Party AdvisoryVDB Entry |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3393 | US Government Resource |
Track CVE-2016-3393 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-3393), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
