Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
According to the CVSS metric, the attack vector is network (AV:N). How could an attacker exploit the vulnerability?
An attacker could trigger this vulnerability by convincing a victim to download and open a document that contains a specially crafted metafile. In the worst-case scenario, an attacker could trigger this vulnerability on web services by uploading documents containing a specially crafted metafile (AV:N) without user interaction. When multiple attack vectors can be used, we assign a score based on the scenario with the higher risk.
According to the CVSS metric, the privilege required is none (PR:N) and user interaction is none (UI:N). What does that mean for this vulnerability?
An attacker doesn't require any privileges on the systems hosting the web services. Successful exploitation of this vulnerability could cause Remote Code Execution or Information Disclosure on web services that are parsing documents that contain a specially crafted metafile, without the involvement of a victim user.
Security updates
16.103.25110922 — https://go.microsoft.com/fwlink/p/?linkid=831049
16.0.19426.20044 — https://support.google.com/googleplay/answer/113412?hl=en
10.0.17763.8027 — https://support.microsoft.com/help/5068791
10.0.20348.4405 — https://support.microsoft.com/help/5068787
10.0.20348.4346 — https://support.microsoft.com/help/5068840
10.0.19044.6575 — https://support.microsoft.com/help/5068781
10.0.26100.7171 — https://support.microsoft.com/help/5068861
10.0.26100.7092 — https://support.microsoft.com/help/5068966
10.0.22631.6199 — https://support.microsoft.com/help/5068865
10.0.25398.1965 — https://support.microsoft.com/help/5068779
10.0.14393.8594 — https://support.microsoft.com/help/5068864
6.0.6003.23624 — https://support.microsoft.com/help/5068906
6.0.6003.23624 — https://support.microsoft.com/help/5068909
6.1.7601.28021 — https://support.microsoft.com/help/5068904
6.1.7601.28021 — https://support.microsoft.com/help/5068908
6.2.9200.25768 — https://support.microsoft.com/help/5068907
6.3.9600.22869 — https://support.microsoft.com/help/5068905
Vulnerabilities 1
-
Critical 9.8
GDI+ Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2025-60724 GDI+ Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss