CVE-2017-0038: Windows GDI gdi32.dll heap memory disclosure via crafted EMF file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityAlthough CVSS is medium (5.5), the very high EPSS score and public exploit code make this a high-priority patching target, especially given the incomplete-fix history.

What it is

gdi32.dll in the Windows Graphics Device Interface fails to properly handle crafted EMF files, specifically an EMR_SETDIBITSTODEVICE record with modified DIB dimensions, allowing disclosure of process heap memory. The flaw is an incomplete fix for CVE-2016-3216, CVE-2016-3219, and CVE-2016-3220, so systems patched for those earlier issues may still be exposed.

Impact

An attacker can read sensitive information from process heap memory, which may include pointers, data from other processes, or other confidential content that aids further exploitation. The CVSS vector shows high confidentiality impact with no integrity or availability impact.

Attack surface

The vulnerability is reached locally (AV:L) with no privileges required (PR:N) but requires user interaction (UI:R), typically opening or rendering a malicious EMF file. The description states remote attackers can obtain information, but the CVSS vector and the crafted-file nature indicate the practical path is a user opening a malicious document or image.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.821, 99.6th percentile) and public exploit code exists on Exploit-DB and GitHub, indicating active interest and availability of proof-of-concept or weaponized code.

What to do

• Apply the Microsoft security update for CVE-2017-0038 as soon as possible, since the flaw is an incomplete fix for earlier GDI CVEs.
• If patching is delayed, consider the 0patch micropatch referenced in the advisory as a temporary mitigation.
• Restrict or block untrusted EMF files at email gateways, web proxies, and endpoint content filters.
• Educate users not to open EMF files or documents containing embedded EMF images from untrusted sources.
• Where feasible, disable or restrict GDI-based rendering of untrusted content in applications that process EMF files.

Detection

• Monitor for processes loading gdi32.dll and subsequently reading or rendering EMF files from untrusted locations such as email attachments or downloads.
• Search endpoint telemetry for EMF file creation or opening events correlated with unusual process memory read behavior.
• Use file analysis or sandboxing to inspect EMF files for EMR_SETDIBITSTODEVICE records with anomalous DIB dimensions.
• Review Windows event logs and EDR alerts for known exploit patterns or public PoC signatures associated with CVE-2017-0038.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.