Vulnerability record · CVE-2019-1009 · published 12 June 2019
CVE-2019-1009: Windows GDI memory disclosure leaks information
Microsoft · Windows 7
The Windows GDI component improperly discloses the contents of its memory, exposing data that should not be readable. An attacker who triggers the flaw can read memory contents and use that information to further compromise the system. The record covers only Windows 7 and Windows Server 2008 and gives no affected version detail beyond those product names.
Description
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Automated analysis
medium priorityCVSS rates it medium (4.7) with high confidentiality impact but a local, high-complexity attack path, and it is not in KEV despite a high EPSS score.
What it is
The Windows GDI component improperly discloses the contents of its memory, exposing data that should not be readable. An attacker who triggers the flaw can read memory contents and use that information to further compromise the system. The record covers only Windows 7 and Windows Server 2008 and gives no affected version detail beyond those product names.
Impact
An attacker gains disclosure of memory contents, which can reveal sensitive data and support follow-on attacks against the host. The CVSS vector rates confidentiality impact as high with no integrity or availability effect.
Attack surface
The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), though the description also mentions opening a crafted document or visiting an untrusted webpage. Reaching the flaw therefore requires local access or a crafted file or page that invokes the GDI component.
Exploitation
Not listed in CISA KEV and no ransomware use is documented. EPSS is 0.48488 (98.8th percentile), indicating elevated predicted exploitation activity, but the references carry no exploit tags and no public exploit is confirmed in this record.
What to do
- Apply the Microsoft security update for CVE-2019-1009 on affected Windows 7 and Windows Server 2008 systems.
- Prioritize patching hosts that still run these end-of-support platforms, since they no longer receive other fixes.
- Restrict local logon and interactive access to trusted users to reduce the low-privilege local path.
- Block or filter untrusted documents and web content that can invoke GDI rendering on unpatched systems.
- Track remaining unpatched instances and plan migration off Windows 7 and Windows Server 2008.
Detection
- Monitor for unexpected crashes or errors in GDI-related processes that could indicate memory disclosure attempts.
- Watch for suspicious document or web content opening followed by unusual process memory reads on affected hosts.
- Audit patch state of Windows 7 and Windows Server 2008 systems for the CVE-2019-1009 update.
- Correlate local low-privilege process activity with access to GDI objects on unpatched endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-1009 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-1009), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
