CVE-2016-3393

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is a remote code execution flaw in the Graphics Device Interface (GDI/GDI+) component of Microsoft Windows. It affects Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607. The issue is tracked as the "Windows Graphics Component RCE Vulnerability" and carries a CVSS 3.1 base score of 7.8.

An attacker can exploit the flaw by serving a crafted web site to a victim. Successful exploitation grants the ability to execute arbitrary code on the target system with the privileges of the logged-on user, provided the user visits the malicious site.

Microsoft addressed the issue in security bulletin MS16-120, which is referenced in public vulnerability databases along with related tracking entries at SecurityFocus and SecurityTracker. Organizations should apply the vendor-supplied updates to eliminate the exposure.