Zscaler

Critical Windows Graphics Vulnerabilities Enable Remote Code Execution

First seen 23 Nov 2025, 03:35 UTC • •44.4

Article Content

1 / 6

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Multiple vulnerabilities in the Windows Graphics Device Interface (GDI) have been identified, allowing remote code execution (RCE) and data leaks. Discovered by Check Point Research, these flaws involve malformed Enhanced Metafile (EMF) records and were patched by Microsoft in several updates throughout 2025. A separate critical flaw (CVE-2025-50165) was also reported, enabling attackers to take control of systems via crafted image files.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 228d ago How this analysis works

Threat Graph

14 entities, 27 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Data Breach
Malware
Remote Code Execution
Zero-day Exploit

Organization (1)

Zscaler ThreatLabz

Vulnerability (3)

CVE-2025-50165
Windows Graphics Component Flaw
Windows Graphics Flaw

Malware (1)

Sturnus

Affected Platform (2)

Microsoft Office
Windows

Tool (3)

Gflags
Ida
WinDbg

Relationships

Sturnus exploits CVE-2025-50165
Sturnus exploits Windows Graphics Component Flaw
Sturnus exploits Windows Graphics Flaw
Gflags exploits CVE-2025-50165
Gflags exploits Windows Graphics Component Flaw
Gflags exploits Windows Graphics Flaw
Ida exploits CVE-2025-50165
Ida exploits Windows Graphics Component Flaw
Ida exploits Windows Graphics Flaw
WinDbg exploits CVE-2025-50165
WinDbg exploits Windows Graphics Component Flaw
WinDbg exploits Windows Graphics Flaw
CVE-2025-50165 targets Microsoft Office
CVE-2025-50165 targets Windows
Windows Graphics Component Flaw targets Microsoft Office
Windows Graphics Component Flaw targets Windows
Windows Graphics Flaw targets Microsoft Office
Windows Graphics Flaw targets Windows
Sturnus targets Zscaler ThreatLabz
Data Breach targets Microsoft Office
Data Breach targets Windows
Malware targets Microsoft Office
Malware targets Windows
Remote Code Execution targets Microsoft Office
Remote Code Execution targets Windows
Zero-day Exploit targets Microsoft Office
Zero-day Exploit targets Windows

Following this threat?

Track Sturnus, Zscaler ThreatLabz and CVE-2025-50165 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed