CVE-2017-0108: Windows Graphics Component buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityAlthough not in KEV, the high EPSS score and public exploit availability combined with a wide attack surface make this a high-priority vulnerability for patching.

What it is

The Windows Graphics Component contains a memory buffer overflow (CWE-119) that can be triggered by a crafted website, leading to arbitrary code execution. It affects a wide range of Microsoft products including Office 2007/2010, Word Viewer, Skype for Business 2016, Lync 2013/2010, Live Meeting 2007, Silverlight 5, and several Windows versions. Because the flaw is in a core graphics component, it is reachable from many applications and poses a broad risk.

Impact

An attacker who successfully exploits this vulnerability can execute arbitrary code in the context of the current user. If the user has administrative privileges, the attacker could take full control of the affected system.

Attack surface

The vulnerability is reached via a crafted website, requiring the user to visit the site or open a malicious document. The CVSS vector indicates local access (AV:L) with user interaction (UI:R) and no privileges required (PR:N), meaning the attacker must convince a user to open a specially crafted file or view a malicious web page.

Exploitation

The CVE is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (0.5047, 98.8th percentile) and a public exploit exists on Exploit-DB (41647).

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com).
• Upgrade or remove unsupported products such as Office 2007, Word Viewer, Live Meeting 2007, and Silverlight 5 where feasible.
• Enforce the principle of least privilege so users do not operate with administrative rights.
• Use email and web filtering to block malicious documents and websites that could trigger the flaw.
• Enable exploit protection features such as DEP and ASLR, and consider disabling unnecessary graphics-related components.

Detection

• Monitor for unusual process creation or code execution originating from Office, Lync, Skype for Business, or Silverlight processes.
• Look for crashes or exceptions in graphics-related DLLs (e.g., gdi32.dll, win32k.sys) that may indicate exploitation attempts.
• Review web proxy and email logs for access to known malicious sites or delivery of crafted documents targeting these products.
• Use endpoint detection to flag suspicious child processes spawned by affected applications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.