Guo Pengfei

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows 7 SP1 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 8.1 and Windows RT 8.1 Microsoft Windows Server 2012 and R2 Microsoft Windows 10 versions Gold, 1511, 1607, 1703 Microsoft Windows Server 2016 **Description** The issue is related to the handling of objects in memory by Graphics in Microsoft Windows, allowing an elevation of privilege. This could potentially be exploited through an untrusted pointer dereference, such as the `fnHKINLPRECT` function. An elevation-of-privilege vulnerability exists, allowing attackers to affect the system. **Recommendations** For Microsoft Windows 7 SP1, apply the relevant patch to fix the elevation of privilege vulnerability. For Microsoft Windows Server 2008 SP2 and R2 SP1, apply the relevant patch to fix the elevation of privilege vulnerability. For Microsoft Windows 8.1 and Windows RT 8.1, apply the relevant patch to fix the elevation of privilege vulnerability. For Microsoft Windows Server 2012 and R2, apply the relevant patch to fix the elevation of privilege vulnerability. For Microsoft Windows 10 versions Gold, 1511, 1607, 1703, apply the relevant patch to fix the elevation of privilege vulnerability. For Microsoft Windows Server 2016, apply the relevant patch to fix the elevation of privilege vulnerability. As a temporary workaround, consider restricting access to the `fnHKINLPRECT` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Windows XP versions SP2 and SP3 Windows Server 2003 version SP2 Windows Vista version SP2 Windows Server 2008 versions SP2 and R2 SP1 Windows 7 version SP1 Windows 8 Windows Server 2012 Windows RT **Description** An issue exists in the Windows kernel-mode driver, allowing local users to gain elevated privileges via a crafted application. This occurs because the driver improperly handles objects in memory. An attacker who successfully exploits this issue could gain elevated privileges and read arbitrary amounts of kernel memory. **Recommendations** For Windows XP SP2 and SP3, update to a newer version to mitigate the risk. For Windows Server 2003 SP2, update to a newer version to mitigate the risk. For Windows Vista SP2, update to a newer version to mitigate the risk. For Windows Server 2008 SP2 and R2 SP1, update to a newer version to mitigate the risk. For Windows 7 SP1, update to a newer version to mitigate the risk. For Windows 8, update to a newer version to mitigate the risk. For Windows Server 2012, update to a newer version to mitigate the risk. For Windows RT, update to a newer version to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista version SP2 Microsoft Windows Server 2008 versions SP2 through R2 SP1 Microsoft Windows 7 version SP1 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows RT **Description** The issue is related to improper handling of objects in memory by the Windows kernel-mode driver, allowing local users to gain privileges via a crafted application. This could enable an attacker to execute arbitrary code with elevated privileges. **Recommendations** For Microsoft Windows XP versions SP2 through SP3, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 version SP2, update to a newer version to mitigate the risk. For Microsoft Windows Vista version SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 versions SP2 through R2 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 7 version SP1, update to a newer version to mitigate the risk. For Microsoft Windows 8, update to a newer version to mitigate the risk. For Microsoft Windows Server 2012, update to a newer version to mitigate the risk. For Microsoft Windows RT, update to a newer version to mitigate the risk.