EXPOSURES › CVE-2019-0903
CVE-2019-0903
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft GDI remote code execution vulnerability allowed attackers to take control of affected systems.
This vulnerability in the Windows Graphics Device Interface (GDI) allowed remote code execution, enabling attackers to gain control of systems. DIB organizations must ensure all Windows systems are patched against this actively exploited vulnerability to prevent compromise and maintain compliance with security requirements.
Shame score — A critical remote code execution vulnerability in a core Windows component was actively exploited in the wild, indicating a failure to patch a known, high-severity issue before it was weaponized.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |