CVE-2017-0001: Windows GDI local privilege escalation via crafted application

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows full local privilege escalation and is confirmed exploited in the wild per CISA KEV, though it requires local access and a crafted binary.

What it is

The Graphics Device Interface (GDI) in multiple Microsoft Windows versions fails to properly handle objects, letting a local user elevate privileges by running a crafted application. Because GDI is a core component present on all listed Windows releases, a successful exploit gives full control of the affected host.

Impact

An attacker who runs code on the machine can escalate from a standard user to SYSTEM-level privileges, gaining the ability to read or modify any data and install programs.

Attack surface

Reached locally by executing a crafted application on the target host; the CVSS vector (AV:L/PR:L/UI:N) indicates low privileges are required and no user interaction beyond running the attacker's program. No remote or network vector is described.

Exploitation

CVE-2017-0001 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), confirming exploitation in the wild, though EPSS 30-day probability is low at 0.031. No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-0001 to all affected Windows versions.
• Prioritize patching of internet-facing and high-value endpoints, since the flaw is on CISA's KEV list with a 2022 remediation deadline.
• Restrict local interactive logon and application execution rights to reduce the pool of users who can run a crafted exploit binary.
• Retire or isolate unsupported end-of-life platforms such as Windows Vista and Windows Server 2008 that cannot receive current fixes.

Detection

• Monitor for unexpected processes spawning with SYSTEM integrity from user-writable directories or unusual parent processes.
• Alert on creation of executables in temp or user profile paths followed by rapid privilege changes or token manipulation.
• Audit Windows event logs for anomalous privilege use (e.g., SeDebugPrivilege, SeTcbPrivilege) by non-administrative accounts.
• Correlate endpoint telemetry for known GDI exploitation patterns against Microsoft's published patch guidance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.