CVE-2019-0903

CVE-2019-0903 is a remote code execution vulnerability in the way the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker who successfully exploits it to take control of the affected system. GDI is a core Windows component, so the flaw is triggered wherever the operating system processes graphics objects, making effectively all Windows installations potential targets. Successful exploitation grants the attacker the ability to run arbitrary code with the privileges of the affected process and take control of the system. Any organization running Windows with the vulnerable GDI component is affected. The vulnerability is confirmed to be exploited in the wild, having been added to the CISA Known Exploited Vulnerabilities catalog on 2022-03-25, and it carries a 21.7% probability of exploitation in the next 30 days (97th percentile EPSS).

What to do: Apply Microsoft security updates for GDI per vendor instructions, as required by CISA's KEV listing, prioritizing systems that handle untrusted content such as documents, fonts, and web graphics. Verify via Windows Update/WSUS or patch management tooling that the relevant Windows security update has been applied to all endpoints and servers, since GDI is present on every Windows machine. Because the vulnerability is confirmed exploited in the wild, treat patching as urgent across the full Windows estate.