CVE-2017-8676

Published: Sep 13, 2017Updated: May 13, 2026 Sources: CVE List NVDCWE-200

3.3LOW

NVD MITRE

Description

The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an authenticated attacker to retrieve information from a targeted system via a specially crafted application, aka "Windows GDI+ Information Disclosure Vulnerability."

In plain language

AI Low urgency

This affects unpatched Windows 7 SP1, Windows 8.1, Windows 10 through 1703, certain Windows Server releases, and older Microsoft Office apps; a typical small business should install Microsoft’s update during normal maintenance.

Executive summary

Authenticated local information disclosure in Windows GDI triggered by a specially crafted application, allowing a standard user to read sensitive information without modifying data or causing a crash.

If affected, business impact

Sensitive local information exposureConfidential business data disclosure

What to do now

Check whether affected Windows or older Microsoft Office software is installed and whether the Microsoft security update for CVE-2017-8676 is missing.
Install the applicable update from Microsoft’s CVE-2017-8676 advisory; the findings do not provide a single fixed version number.
Limit standard-user access on shared computers until updates are installed.

Patch / advisory Some work to apply

What is it

This is a flaw in a Windows component that handles graphics-related requests. Think of it like a locked filing cabinet that a person already inside the office can peek into without being allowed to open it: it may reveal private information, but it does not let them alter files or shut down the computer.

Who is affected

This matters to you if you run Windows Graphics Device Interface (GDI) on an affected, unpatched Windows computer. An attacker must already have local access and be signed in as a standard user; it is not a risk merely from being reachable on the internet.

How urgent is it

No known public exploit code is available, and this issue is not listed in CISA’s catalog of vulnerabilities known to be exploited. Treat it as a low-priority update, but include it in routine patching because a signed-in local user could access sensitive information.

What to do — in detail

Confirm exposure by inventorying affected Windows and older Office installations, then checking their installed Microsoft security updates against the MSRC advisory for CVE-2017-8676.

The findings do not identify a single fixed version for each branch. Deploy the Microsoft security update applicable to each installed Windows or Office branch through your normal update process; review the advisory for the matching package.

No upgrade-path or breaking-change information is provided in the findings. If patching is delayed, reduce access to affected shared devices and prevent untrusted users from running applications locally. There is no CISA KEV remediation due date because this CVE is not in KEV. Monitor update deployment status and investigate unexpected application execution by standard-user accounts.

Technical context

CVSS 3.3 (Low): CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The weakness is CWE-200 information exposure through a local, authenticated attack using a crafted application; it affects confidentiality only. EPSS predicts a 14.0% likelihood and is rising, but there is no public exploit code on record. CISA KEV does not list this CVE, so there is no confirmed KEV exploitation status or KEV due date.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.