CVE-2017-0108 — The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Graphics Component Remote Code Execution Vulnerability." This vulnerability is different from that described in CVE-2017-0014

Back Back to CVE browser

HIGH

The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Graphics Component Remote Code Execution Vulnerability." This vulnerability is different from that described in CVE-2017-0014

Published Mar 17, 2017

7.8

HIGH

CVSS 3.0

EPSS 50.47%

Description

The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Graphics Component Remote Code Execution Vulnerability." This vulnerability is different from that described in CVE-2017-0014.

Affected products

Vendor Microsoft Corporation Product Windows Graphics Component Default
n/a
- Version
  The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft Corporation

Windows Graphics Component

n/a

Version	Status	Constraints
The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1	affected	-

Remediation

No remediation recorded yet.

Metrics

50.47% 0.50470

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.50470

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (40 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	50.47% (0.50470)	98.88th	v5 (v2026.06.15)
Sep 22, 2026	50.47% (0.50470)	98.86th	v5 (v2026.06.15)
Sep 21, 2026	59.39% (0.59393)	99.10th	v5 (v2026.06.15)
Sep 6, 2026	50.47% (0.50470)	98.84th	v5 (v2026.06.15)
Sep 5, 2026	59.39% (0.59393)	99.08th	v5 (v2026.06.15)
Aug 30, 2026	50.47% (0.50470)	98.83th	v5 (v2026.06.15)
Aug 28, 2026	59.39% (0.59393)	99.08th	v5 (v2026.06.15)
Aug 24, 2026	50.47% (0.50470)	98.82th	v5 (v2026.06.15)
Aug 23, 2026	59.39% (0.59393)	99.07th	v5 (v2026.06.15)
Jun 15, 2026	50.47% (0.50470)	98.77th	v5 (v2026.06.15)
Mar 7, 2026	36.71% (0.36707)	97.06th	v4 (v2025.03.14)
Jan 10, 2026	33.75% (0.33745)	96.80th	v4 (v2025.03.14)
Aug 1, 2025	36.29% (0.36288)	96.98th	v4 (v2025.03.14)
May 22, 2025	39.11% (0.39113)	97.08th	v4 (v2025.03.14)
Mar 30, 2025	25.97% (0.25966)	95.82th	v4 (v2025.03.14)
Mar 29, 2025	74.73% (0.74735)	98.52th	v4 (v2025.03.14)
Mar 28, 2025	25.97% (0.25966)	95.82th	v4 (v2025.03.14)
Mar 27, 2025	74.73% (0.74735)	98.76th	v4 (v2025.03.14)
Mar 20, 2025	25.97% (0.25966)	95.84th	v4 (v2025.03.14)
Mar 19, 2025	74.73% (0.74735)	98.78th	v4 (v2025.03.14)
Mar 17, 2025	25.97% (0.25966)	95.83th	v4 (v2025.03.14)
Dec 17, 2024	20.34% (0.20338)	96.35th	v3 (v2023.03.01)
Sep 29, 2024	16.66% (0.16657)	96.11th	v3 (v2023.03.01)
Aug 27, 2024	19.13% (0.19132)	96.36th	v3 (v2023.03.01)
Aug 13, 2024	14.47% (0.14469)	95.84th	v3 (v2023.03.01)
Aug 10, 2024	16.81% (0.16808)	96.12th	v3 (v2023.03.01)
May 9, 2024	14.47% (0.14469)	95.71th	v3 (v2023.03.01)
Feb 18, 2024	15.93% (0.15926)	95.77th	v3 (v2023.03.01)
Jan 5, 2024	14.67% (0.14668)	95.25th	v3 (v2023.03.01)
Nov 27, 2023	12.92% (0.12918)	94.94th	v3 (v2023.03.01)
Sep 10, 2023	13.28% (0.13279)	94.86th	v3 (v2023.03.01)
Aug 1, 2023	11.84% (0.11844)	94.55th	v3 (v2023.03.01)
Jun 20, 2023	10.72% (0.10719)	94.24th	v3 (v2023.03.01)
Apr 1, 2023	10.80% (0.10803)	94.14th	v3 (v2023.03.01)
Mar 7, 2023	9.42% (0.09420)	93.71th	v3 (v2023.03.01)
Mar 6, 2023	84.18% (0.84184)	99.63th	v2 (v2022.01.01)
Feb 4, 2022	84.18% (0.84184)	99.55th	v2 (v2022.01.01)
Feb 3, 2022	55.96% (0.55960)	99.15th	v1
Sep 1, 2021	55.96% (0.55960)	99.74th	v1
Apr 14, 2021	55.96% (0.55960)	0.00th	v1

Weaknesses (1)

CWE-119

Buffer Overflow

References (4)

http://www.securityfocus.com/bid/96722
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038002
vdb-entryx_refsource_SECTRACK
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0108
x_refsource_CONFIRMPatchVendor Advisory
https://www.exploit-db.com/exploits/41647/
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://www.securityfocus.com/bid/96722		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038002		vdb-entryx_refsource_SECTRACK
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0108		x_refsource_CONFIRMPatchVendor Advisory
https://www.exploit-db.com/exploits/41647/		exploitx_refsource_EXPLOIT-DB

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Mar 17, 2017

Updated Aug 5, 2024

Reserved Sep 9, 2016

Link CVE-2017-0108

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-0108

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-0108