CVE-2017-0005: Windows GDI local privilege escalation via crafted application

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a known-exploited local privilege escalation (CISA KEV) with high CVSS impact, though it requires local access and is an older, patched issue.

What it is

The Graphics Device Interface (GDI) in multiple Microsoft Windows versions mishandles objects in a way that lets a local user elevate privileges by running a crafted application. It affects a broad set of Windows releases from Vista through Windows 10 1607 and corresponding server editions. Because it is a local privilege escalation in a core graphics component, it matters as a post-compromise step to gain higher rights on a host.

Impact

An attacker who can already run code on the machine gains elevated privileges, potentially SYSTEM-level access depending on the exploit. That enables further actions such as disabling security controls, persisting, or moving laterally.

Attack surface

Reached locally by executing a crafted application on the target host; the CVSS vector AV:L/PR:L/UI:N indicates low privileges are required and no user interaction beyond running the attacker's program. No remote or network vector is described.

Exploitation

It is listed in CISA KEV (added 2022-05-24), and the Microsoft MMPC reference is tagged Exploit, indicating known exploitation; EPSS 30-day probability is about 0.11 (95.7th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update for CVE-2017-0005 to all affected Windows versions; this is the primary fix.
• Prioritize patching hosts running the affected legacy platforms (Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8.1, RT 8.1, Server 2012/R2, Windows 10 Gold/1511/1607).
• Restrict the ability of low-privileged users to run untrusted executables, and remove local admin rights where feasible to reduce the value of a local EoP.
• Use application allowlisting and endpoint controls to block execution of unknown binaries that could trigger the GDI flaw.
• Monitor and retire end-of-support systems that cannot receive the patch.

Detection

• Monitor for processes spawning with unexpectedly high integrity or SYSTEM tokens from user-writable paths or unusual parent processes.
• Alert on known exploit artifacts and behaviors described in the Microsoft MMPC detection guidance for this CVE.
• Track execution of unsigned or newly written binaries from temp, download, or user profile directories on affected hosts.
• Correlate local privilege escalation indicators with prior initial-access activity on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.