CVE-2019-0903
Published: 16 May 2019
Summary
CVE-2019-0903 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10 1709. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. The issue, tracked as CVE-2019-0903 and also referred to as the GDI+ Remote Code Execution Vulnerability, affects the GDI+ component on Windows systems and carries a CVSS 3.1 score of 8.8.
An attacker can exploit the flaw over a network without authentication, provided the victim performs an action such as opening a specially crafted document or image. Successful exploitation grants the attacker the ability to execute arbitrary code with the same privileges as the affected user, resulting in full compromise of confidentiality, integrity, and availability.
Microsoft has published patches and guidance through its Security Response Center advisory for CVE-2019-0903. The vulnerability appears in the CISA Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-1652
Vulnerability details
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of Microsoft patches that remediate the GDI+ memory-handling flaw before exploitation.
Enforces memory protections that block the object-handling corruption used to achieve remote code execution.
Requires validation of image/document inputs that an attacker must supply to trigger the GDI+ flaw.