CVE-2017-0190

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI Information Disclosure Vulnerability."

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Microsoft Corporation	Microsoft Windows	Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016

References

http://www.securityfocus.com/bid/98298Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038451
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0190Patch, Vendor Advisory
http://www.securityfocus.com/bid/98298Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038451
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0190Patch, Vendor Advisory

Timeline

Published: May 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-01915.8A denial of service vulnerability exists in the way that Windows 7, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, Wi CVE-2017-01924.3The Adobe Type Manager Font Driver (ATMFD.dll) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.CVE-2017-01937.8Windows Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1 CVE-2017-01945.5Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, and Office Compatibility Pack SP2 allow remote attackers to obtain sensitive information CVE-2017-01955.4Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 CVE-2017-01966.5An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process m CVE-2017-01977.8Microsoft OneNote 2007 SP3 and Microsoft OneNote 2010 SP2 allow remote attackers to execute arbitrary code via a crafted document, aka "Micr CVE-2017-01997.8Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows CVE-2017-02007.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memo CVE-2017-02017.5A remote code execution vulnerability exists in Internet Explorer in the way that the JScript and VBScript engines render when handling obje CVE-2017-02027.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt m CVE-2017-02034.3A vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted do