PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-0038 Microsoft CVE debrief

CVE-2017-0038 is a Microsoft Windows information disclosure issue in gdi32.dll/GDI. A crafted EMF file can expose process heap memory when the EMR_SETDIBITSTODEVICE record uses modified Device Independent Bitmap dimensions. The CVE record notes that this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220. The official CVE was published on 2017-02-20; the 2026 modified timestamp reflects later record maintenance, not the original disclosure date.

Vendor
Microsoft
Product
CVE-2017-0038
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Windows administrators, endpoint security teams, and application owners that accept, preview, print, or render untrusted EMF/metafile content. Document-processing workflows, remote support tools, and software that relies on Windows GDI rendering should treat this as a relevant confidentiality risk.

Technical summary

NVD describes the issue as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, which matches a user-interaction-dependent disclosure bug rather than code execution. The vulnerable component is gdi32.dll in Windows GDI, and the trigger described in the source corpus is a crafted EMF file with altered DIB dimensions inside an EMR_SETDIBITSTODEVICE record. The supplied NVD CPE criteria list multiple affected Windows client and server releases, including Windows Vista SP2 through Windows 10 1607 and several Server editions.

Defensive priority

Medium. Prioritize patching on systems that handle untrusted EMF or other GDI-rendered content, especially in document preview, rendering, or print-centric environments. The user-interaction requirement lowers immediate wormability, but the confidentiality impact is high for exposed endpoints.

Recommended defensive actions

  • Apply the Microsoft security update associated with CVE-2017-0038 on all affected Windows systems.
  • Validate patch coverage across every listed client and server SKU in your environment, including legacy hosts that still process EMF content.
  • Reduce exposure to untrusted EMF/metafile content in document preview, print, and rendering pipelines where feasible.
  • Run document-processing and preview services with least privilege and isolate them from higher-value data.
  • Treat prior mitigations for CVE-2016-3216, CVE-2016-3219, and CVE-2016-3220 as insufficient unless current patch levels confirm this issue is addressed.
  • Review any software that imports or renders user-supplied EMF files and test it after patching for compatibility issues.

Evidence notes

The vulnerability description supplied in the corpus states that gdi32.dll in Windows GDI allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, specifically involving an EMR_SETDIBITSTODEVICE record with modified DIB dimensions. NVD classifies the weakness as CWE-200 and assigns CVSS 3.0 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The published date in the source is 2017-02-20, and the later 2026-05-13 modified timestamp should be treated as database maintenance context only. The supplied NVD CPE criteria indicate multiple affected Windows client and server releases.

Official resources

Public CVE assignment occurred on 2017-02-20. The supplied modified date of 2026-05-13 is a later record update and should not be read as the original disclosure date. The source corpus links the issue to Microsoft guidance and the NVD CVE