CVE-2017-0005

A local privilege escalation flaw in Windows GDI allowed attackers to gain elevated access via a crafted application.

This vulnerability allowed local users to escalate privileges without remote access, limiting direct DIB exposure but highlighting the risk of unpatched, actively exploited (KEV) flaws in widely deployed OS. DIBs must ensure all Windows systems are patched against known KEV vulnerabilities to prevent lateral movement and compliance failures. The flaw was not a zero-day but was actively exploited in the wild, demonstrating the danger of relying on unpatched legacy systems.

Shame score — Microsoft failed to patch a known, actively exploited privilege escalation vulnerability in a widely deployed OS, allowing attackers to escalate local privileges without remote access.