CVE-2017-0108

What it actually does

The vulnerability permits remote code execution through memory corruption in the Windows Graphics Component when processing specially crafted content from untrusted sources such as web pages.

Why it matters to the business

Successful exploitation can lead to full system compromise, enabling attackers to steal data, install persistent malware, or disrupt operations across legacy Microsoft Office, Lync, Silverlight, and Windows endpoints that remain unpatched.

How an attack unfolds

An attacker hosts a malicious website embedding a crafted graphics payload. When a victim using an affected product visits the page, the graphics component processes the malformed data, triggering memory corruption that allows arbitrary code execution in the context of the logged-on user.

How to fix it

Apply the security updates released by Microsoft for each affected product version. Where updates are unavailable, isolate or decommission legacy systems and disable unnecessary graphics rendering features in Office and browser configurations.

How to confirm the fix worked

Verify that all listed products have received the corresponding Microsoft security updates by checking installed update history or using the Microsoft Update Catalog. Re-scan systems with vulnerability assessment tools to confirm the flaw is no longer present.

Typical attack path

1. Attacker prepares a crafted graphics payload targeting the vulnerable component
2. Payload is hosted on a malicious or compromised website
3. Victim is lured to the site via phishing or watering-hole tactics
4. Affected application or browser renders the page and invokes the graphics component
5. Memory corruption occurs, leading to arbitrary code execution

How to detect it

Review web proxy logs, browser history, and Office crash dumps for access to suspicious external sites followed by unexpected process creation or graphics-related errors. Correlate with endpoint telemetry showing abnormal code execution after rendering web content.

What your security team should do

• Prioritize patching of any remaining Windows 7, Server 2008, Vista, Office 2007/2010, Lync, and Silverlight 5 installations
• Implement application whitelisting and restrict web browsing on legacy endpoints
• Monitor for continued use of unsupported products and plan migration or decommissioning
• Review network segmentation to limit exposure of unpatched systems