Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Windows GDI allows remote code execution via malicious image files

CVE-2009-0081 · published 17 years ago
Summary

Windows versions from 2000 through Server 2008 have a flaw in the graphics component that can be triggered by specially crafted picture files. An attacker could use such a file to run their own programs on the target computer. Install the latest security updates from Microsoft to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_2000 All versions
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
microsoft windows_server_2003 All versions
cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
microsoft windows_server_2008 All versions
cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*
microsoft windows_vista gold
cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
microsoft windows_xp All versions
cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:*
Original advisory text
The graphics device interface (GDI) implementation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly valida...
The graphics device interface (GDI) implementation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate input received from user mode, which allows remote attackers to execute arbitrary code via a crafted (1) Windows Metafile (aka WMF) or (2) Enhanced Metafile (aka EMF) image file, aka "Windows Kernel Input Validation Vulnerability."
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
32% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published10 Mar 2009
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2009-0081 · NVD
Track software like this
Free during beta