CVE-2017-8676

Exploitation likely. EPSS gives it a 14% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.03.3Low EPSS percentile96th14% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2017-09-13Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether affected Windows or older Microsoft Office software is installed and whether the Microsoft security update for CVE-2017-8676 is missing.
Install the applicable update from Microsoft’s CVE-2017-8676 advisory; the findings do not provide a single fixed version number.
Limit standard-user access on shared computers until updates are installed.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an authenticated attacker to retrieve information from a targeted system via a specially crafted application, aka "Windows GDI+ Information Disclosure Vulnerability."

In plain language

Written by AI from the record

This affects unpatched Windows 7 SP1, Windows 8.1, Windows 10 through 1703, certain Windows Server releases, and older Microsoft Office apps; a typical small business should install Microsoft’s update during normal maintenance.

Authenticated local information disclosure in Windows GDI triggered by a specially crafted application, allowing a standard user to read sensitive information without modifying data or causing a crash.

If you're affected

Sensitive local information exposure
Confidential business data disclosure

What is it

This is a flaw in a Windows component that handles graphics-related requests. Think of it like a locked filing cabinet that a person already inside the office can peek into without being allowed to open it: it may reveal private information, but it does not let them alter files or shut down the computer.

Who is affected

This matters to you if you run Windows Graphics Device Interface (GDI) on an affected, unpatched Windows computer. An attacker must already have local access and be signed in as a standard user; it is not a risk merely from being reachable on the internet.

How urgent is it

No known public exploit code is available, and this issue is not listed in CISA’s catalog of vulnerabilities known to be exploited. Treat it as a low-priority update, but include it in routine patching because a signed-in local user could access sensitive information.

What to do — in detail

Confirm exposure by inventorying affected Windows and older Office installations, then checking their installed Microsoft security updates against the MSRC advisory for CVE-2017-8676.

The findings do not identify a single fixed version for each branch. Deploy the Microsoft security update applicable to each installed Windows or Office branch through your normal update process; review the advisory for the matching package.

No upgrade-path or breaking-change information is provided in the findings. If patching is delayed, reduce access to affected shared devices and prevent untrusted users from running applications locally. There is no CISA KEV remediation due date because this CVE is not in KEV. Monitor update deployment status and investigate unexpected application execution by standard-user accounts.

Technical context

CVSS 3.3 (Low): CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The weakness is CWE-200 information exposure through a local, authenticated attack using a crafted application; it affects confidentiality only. EPSS predicts a 14.0% likelihood and is rising, but there is no public exploit code on record. CISA KEV does not list this CVE, so there is no confirmed KEV exploitation status or KEV due date.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

14% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

24 events over 3297 days, from the signal feeds we watch.

2026-09-23EPSS band change0 → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

microsoftcommercial · US
- live meetingDesktop AppOn-premCommunications / video-conferencing
- lyncWeb AppOn-premCommunications / messaging-chat
- officeDesktop AppConsumer Software / productivity
- office 2007On-premOperating Systems / windows
- office 2010On-premOperating Systems / windows
- office word viewerDesktop AppOn-premConsumer Software / productivity
- skype for businessDesktop AppOn-premCommunications / messaging-chat
- windows 10OSOn-premOperating Systems / windows
Microsoft Corporationcommercial · USaka microsoft
- Windows Graphics Device Interface (GDI)OSOn-premOperating Systems / windows

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Scored 3.3 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity NoneNo integrity impact
Availability NoneNo availability impact