CVE-2016-3393

Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."

• https://www.securityfocus.com/bid/93377Broken Link, Third Party Advisory, VDB Entry
• https://www.securitytracker.com/id/1036988Broken Link, Third Party Advisory, VDB Entry
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120Patch, Vendor Advisory
• https://www.securityfocus.com/bid/93377Broken Link, Third Party Advisory, VDB Entry
• https://www.securitytracker.com/id/1036988Broken Link, Third Party Advisory, VDB Entry
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-120Patch, Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3393US Government Resource

Published

Oct 14, 2016

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3387Microsoft Internet Explorer 10 and 11 and Microsoft Edge do …
• CVE-2016-3388Microsoft Internet Explorer 10 and 11 and Microsoft Edge do …
• CVE-2016-3389The Chakra JavaScript engine in Microsoft Edge allows remote…
• CVE-2016-3390The scripting engines in Microsoft Internet Explorer 11 and …
• CVE-2016-3391Microsoft Internet Explorer 10 and 11 and Microsoft Edge all…
• CVE-2016-3392The Edge Content Security Policy feature in Microsoft Edge d…
• CVE-2016-3394Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-3395Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-3396Graphics Device Interface (aka GDI or GDI+) in Microsoft Win…
• CVE-2016-3397Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-3399Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2016-3400NetApp Data ONTAP 8.1 and 8.2, when operating in 7-Mode, all…