CVE-2011-5046

CVE-2011-5046 is a critical vulnerability affecting the Graphics Device Interface (GDI) in win32k.sys across multiple Microsoft Windows versions, including XP, Vista, and Windows 7. This flaw allows remote attackers to execute arbitrary code or cause a denial of service through memory corruption by providing malformed user-mode input, such as a large IFRAME height attribute rendered by Safari. With a CVSS score of 9.3, it is a high-severity vulnerability requiring no authentication and having high impact on confidentiality, integrity, and availability, though it requires medium attack complexity. While not listed in CISA's KEV catalog, an ExploitDB entry exists for a denial-of-service attack, and its EPSS score indicates a high probability of exploitation. Despite this, there is no evidence of active exploitation, and it has received minimal community discussion or media coverage.