CVE-2020-17098: 
vulnerability analysis and mitigation

Windows GDI+ Information Disclosure Vulnerability (CVE-2020-17098) was disclosed on December 8, 2020. This vulnerability affects multiple versions of Microsoft Windows operating systems, including Windows 10, Windows Server 2016, Windows Server 2019, and various server core installations (NVD).

The vulnerability has been assigned a CVSS 3.1 Base Score of 5.5 MEDIUM with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction to exploit. The impact is primarily focused on confidentiality, with no impact on integrity or availability (NVD).

The vulnerability could allow an attacker to obtain sensitive information from the affected system. When successfully exploited, it enables information disclosure with high confidentiality impact, though it does not affect system integrity or availability (NVD).

The vulnerability has been assessed with a 'Exploitation Less Likely' rating for both latest and older software releases. There is no evidence of this vulnerability being publicly disclosed or exploited in the wild at the time of reporting (NVD).

Microsoft has released security updates to address this vulnerability. Users should apply the appropriate security update for their specific version of Windows through the Microsoft Update service (Microsoft Advisory).