Skip to content
OpenAdvisories
Critical MSRC-CVE-2025-60724 1 CVE

GDI+ Remote Code Execution Vulnerability

Published Nov 11, 2025 · Updated Nov 11, 2025

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.

According to the CVSS metric, the attack vector is network (AV:N). How could an attacker exploit the vulnerability?
An attacker could trigger this vulnerability by convincing a victim to download and open a document that contains a specially crafted metafile. In the worst-case scenario, an attacker could trigger this vulnerability on web services by uploading documents containing a specially crafted metafile (AV:N) without user interaction. When multiple attack vectors can be used, we assign a score based on the scenario with the higher risk.

According to the CVSS metric, the privilege required is none (PR:N) and user interaction is none (UI:N). What does that mean for this vulnerability?
An attacker doesn't require any privileges on the systems hosting the web services. Successful exploitation of this vulnerability could cause Remote Code Execution or Information Disclosure on web services that are parsing documents that contain a specially crafted metafile, without the involvement of a victim user.

Security updates
16.103.25110922 — https://go.microsoft.com/fwlink/p/?linkid=831049
16.0.19426.20044 — https://support.google.com/googleplay/answer/113412?hl=en
10.0.17763.8027 — https://support.microsoft.com/help/5068791
10.0.20348.4405 — https://support.microsoft.com/help/5068787
10.0.20348.4346 — https://support.microsoft.com/help/5068840
10.0.19044.6575 — https://support.microsoft.com/help/5068781
10.0.26100.7171 — https://support.microsoft.com/help/5068861
10.0.26100.7092 — https://support.microsoft.com/help/5068966
10.0.22631.6199 — https://support.microsoft.com/help/5068865
10.0.25398.1965 — https://support.microsoft.com/help/5068779
10.0.14393.8594 — https://support.microsoft.com/help/5068864
6.0.6003.23624 — https://support.microsoft.com/help/5068906
6.0.6003.23624 — https://support.microsoft.com/help/5068909
6.1.7601.28021 — https://support.microsoft.com/help/5068904
6.1.7601.28021 — https://support.microsoft.com/help/5068908
6.2.9200.25768 — https://support.microsoft.com/help/5068907
6.3.9600.22869 — https://support.microsoft.com/help/5068905

Vulnerabilities 1

Revision history

  1. #1

    Information published.

References