CVE-2019-0903

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. The issue, tracked as CVE-2019-0903 and also referred to as the GDI+ Remote Code Execution Vulnerability, affects the GDI+ component on Windows systems and carries a CVSS 3.1 score of 8.8.

An attacker can exploit the flaw over a network without authentication, provided the victim performs an action such as opening a specially crafted document or image. Successful exploitation grants the attacker the ability to execute arbitrary code with the same privileges as the affected user, resulting in full compromise of confidentiality, integrity, and availability.

Microsoft has published patches and guidance through its Security Response Center advisory for CVE-2019-0903. The vulnerability appears in the CISA Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation.