EXPOSURES › CVE-2016-3393
CVE-2016-3393
HIGH ⌖ ON CISA KEV · EXPLOITEDA remote code execution flaw in Windows GDI allowed attackers to take control of systems, remaining unpatched long enough to be added to CISA's KEV catalog.
Microsoft's GDI component mishandled memory objects, enabling remote code execution that attackers exploited before a patch existed. DIB organizations must ensure all Windows systems are patched immediately and monitor KEV for similar unpatched, actively exploited vulnerabilities. This failure highlights the risk of relying on vendors to patch critical flaws promptly.
Shame score — A critical RCE flaw remained unpatched long enough to be actively exploited and added to CISA's KEV catalog, demonstrating negligence in patch management and leaving systems vulnerable to attackers.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |