Google Project Zero researchers are warning of an unpatched Microsoft vulnerability in the Windows’ GDI library that allows attackers to steal sensitive data from program memory.