CVE-2019-0903
Microsoft GDI Remote Code Execution Vulnerability
Description
CVE-2019-0903 is a remote code execution vulnerability in the Microsoft Windows Graphics Device Interface (GDI) that can be exploited through specially crafted Enhanced Metafile (EMF) images. An attacker can trigger the vulnerability by convincing a user to open a malicious document or visit a website containing a crafted EMF file. Successful exploitation allows the attacker to execute arbitrary code with the privileges of the current user. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022, with an EPSS score of 12.1% (95.4th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1903 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 1903 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0903(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0903(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2019-0903 is associated with CWE-94, which describes vulnerabilities where improper handling of input leads to code execution. The Windows GDI component improperly handles objects in memory when processing EMF image files, leading to a condition where an attacker can execute arbitrary code in the context of the current user.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2019-0903 allows attackers to execute arbitrary code on Windows systems through malicious EMF image files processed by the GDI subsystem. The code executes with the privileges of the user who opens the malicious content, which could be an administrator with full system access. The vulnerability can be triggered through multiple attack vectors including email attachments containing crafted documents, websites serving malicious EMF content, and shared network files. If the victim user has administrative privileges, the attacker gains full control of the system. The EPSS score of 12.1% reflects active exploitation interest, and the ubiquity of Windows systems makes the potential attack surface very broad.
Exploit Maturity
CVE-2019-0903 has been confirmed as actively exploited in the wild by CISA. The vulnerability can be delivered through common attack vectors such as phishing emails with malicious document attachments or drive-by download attacks via compromised websites. EMF file-based attacks are a well-established technique in targeted attack campaigns. With an EPSS score of 12.1% (95.4th percentile), the exploitation likelihood is significant.
Remediation
- Apply Microsoft security updates: Install the May 2019 cumulative security update from Microsoft that addresses CVE-2019-0903.
- Restrict EMF file processing: Configure email gateways and content filters to block or quarantine files containing EMF content.
- Implement least privilege: Ensure users operate with the minimum required privileges, avoiding administrative accounts for daily tasks.
- Deploy endpoint protection: Ensure endpoint security solutions are updated with signatures capable of detecting CVE-2019-0903 exploitation attempts.
- Educate users: Train users to recognize and avoid opening suspicious email attachments or downloading files from untrusted sources.
Technical Details
CVE-2019-0903 is a remote code execution vulnerability in the Windows Graphics Device Interface (GDI), which is the core Windows subsystem responsible for rendering graphics and processing image formats. The vulnerability occurs when GDI improperly handles objects in memory while processing Enhanced Metafile (EMF) format images. EMF files contain a sequence of GDI drawing commands that are replayed to render graphics, and a specially crafted EMF file can include commands that trigger a memory corruption condition in the GDI processing engine. This memory corruption allows an attacker to achieve arbitrary code execution in the context of the user who opened or previewed the malicious file. The attack can be delivered through any application that processes EMF files, including web browsers, email clients, and document viewers.
Frequently Asked Questions
Is CVE-2019-0903 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2019-0903. The vulnerability can be triggered through common attack vectors like phishing emails with malicious documents or compromised websites.
What products are affected by CVE-2019-0903?
CVE-2019-0903 affects all supported versions of Microsoft Windows that include the Windows GDI component, which is a core operating system subsystem present in all Windows versions.
How do I fix CVE-2019-0903?
Apply the May 2019 cumulative security update from Microsoft. Ensure all Windows systems are enrolled in a regular patching program. Implement email filtering to block malicious EMF attachments.
How severe is CVE-2019-0903?
CVE-2019-0903 is a high-severity remote code execution vulnerability. It can be exploited through common delivery mechanisms like email attachments, and successful exploitation allows code execution with the victim user's privileges, potentially leading to full system compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.