Skip to content
OpenAdvisories
Critical MSRC-CVE-2025-53766 1 CVE

GDI+ Remote Code Execution Vulnerability

Published Aug 12, 2025 · Updated Aug 12, 2025

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the privilege required is none (PR:N) and user interaction is none (UI:N). What does that mean for this vulnerability?
An attacker doesn't require any privileges on the systems hosting the web services. Successful exploitation of this vulnerability could cause Remote Code Execution or Information Disclosure on web services that are parsing documents that contain a specially crafted metafile, without the involvement of a victim user.

According to the CVSS metric, the attack vector is network (AV:N). How could an attacker exploit the vulnerability?
An attacker could trigger this vulnerability by convincing a victim to download and open a document that contains a specially crafted metafile. In the worst-case scenario, an attacker could trigger this vulnerability on web services by uploading documents containing a specially crafted metafile (AV:N) without user interaction. When multiple attack vectors can be used, we assign a score based on the scenario with the higher risk.

Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.

Security updates
10.0.17763.7678 — https://support.microsoft.com/help/5063877
10.0.20348.4052 — https://support.microsoft.com/help/5063880
10.0.20348.3989 — https://support.microsoft.com/help/5063812
10.0.19044.6216 — https://support.microsoft.com/help/5063709
10.0.22621.5768 — https://support.microsoft.com/help/5063875
10.0.26100.4946 — https://support.microsoft.com/help/5063878
10.0.26100.4851 — https://support.microsoft.com/help/5064010
10.0.25398.1791 — https://support.microsoft.com/help/5063899
10.0.10240.21100 — https://support.microsoft.com/help/5063889
10.0.14393.8330 — https://support.microsoft.com/help/5063871
6.0.6003.23471 — https://support.microsoft.com/help/5063888
6.0.6003.23471 — https://support.microsoft.com/help/5063948
6.1.7601.27872 — https://support.microsoft.com/help/5063947
6.1.7601.27872 — https://support.microsoft.com/help/5063927
6.2.9200.25622 — https://support.microsoft.com/help/5063906
6.3.9600.22725 — https://support.microsoft.com/help/5063950
16.0.19127.20000 — https://support.google.com/googleplay/answer/113412?hl=en
16.0.14326.22618 — https://support.microsoft.com/en-us/account-billing/get-updates-for-apps-and-games-in-microsoft-store-a1fe19c0-532d-ec47-7035-d1c5a1dd464f

Vulnerabilities 1

Revision history

  1. #1

    Information published.

References