PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-0038 Microsoft CVE debrief

CVE-2017-0038 is a Microsoft Windows information disclosure issue in gdi32.dll/GDI. A crafted EMF file can expose process heap memory when the EMR_SETDIBITSTODEVICE record uses modified Device Independent Bitmap dimensions. The CVE record notes that this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220. The official CVE was published on 2017-02-20; the 2026 modified timestamp reflects later record maintenance, not the original disclosure date.

Vendor
Microsoft
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Windows administrators, endpoint security teams, and application owners that accept, preview, print, or render untrusted EMF/metafile content. Document-processing workflows, remote support tools, and software that relies on Windows GDI rendering should treat this as a relevant confidentiality risk.

Technical summary

NVD describes the issue as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, which matches a user-interaction-dependent disclosure bug rather than code execution. The vulnerable component is gdi32.dll in Windows GDI, and the trigger described in the source corpus is a crafted EMF file with altered DIB dimensions inside an EMR_SETDIBITSTODEVICE record. The supplied NVD CPE criteria list multiple affected Windows client and server releases, including Windows Vista SP2 through Windows 10 1607 and several Server editions.

Defensive priority

Medium. Prioritize patching on systems that handle untrusted EMF or other GDI-rendered content, especially in document preview, rendering, or print-centric environments. The user-interaction requirement lowers immediate wormability, but the confidentiality impact is high for exposed endpoints.

Recommended defensive actions

  • Apply the Microsoft security update associated with CVE-2017-0038 on all affected Windows systems.
  • Validate patch coverage across every listed client and server SKU in your environment, including legacy hosts that still process EMF content.
  • Reduce exposure to untrusted EMF/metafile content in document preview, print, and rendering pipelines where feasible.
  • Run document-processing and preview services with least privilege and isolate them from higher-value data.
  • Treat prior mitigations for CVE-2016-3216, CVE-2016-3219, and CVE-2016-3220 as insufficient unless current patch levels confirm this issue is addressed.
  • Review any software that imports or renders user-supplied EMF files and test it after patching for compatibility issues.

Evidence notes

The vulnerability description supplied in the corpus states that gdi32.dll in Windows GDI allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, specifically involving an EMR_SETDIBITSTODEVICE record with modified DIB dimensions. NVD classifies the weakness as CWE-200 and assigns CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The published date in the source is 2017-02-20, and the later 2026-05-13 modified timestamp should be treated as database maintenance context only. The supplied NVD CPE criteria indicate multiple affected Windows client and server releases.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-0038 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-0038

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-0038 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-0038

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.