Zscaler

Critical Windows Graphics Vulnerabilities Enable Remote Code Execution

First seen 23 Nov 2025, 03:35 UTC • Cybersecuritynews

•40% similarity •44.4

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Multiple vulnerabilities in the Windows Graphics Device Interface (GDI) have been identified, allowing remote code execution (RCE) and data leaks. Discovered by Check Point Research, these flaws involve malformed Enhanced Metafile (EMF) records and were patched by Microsoft in several updates throughout 2025. A separate critical flaw (CVE-2025-50165) was also reported, enabling attackers to take control of systems via crafted image files.

ThreatCluster AI

Attack Flow

17 entities, 34 inferred relationships (STIX 2.1).

Technique (6)

Data Breach
Malware
Remote Code Execution
Zero-day Exploit
Heap Spraying
Return-Oriented Programming

Organization (1)

Zscaler ThreatLabz

Vulnerability (3)

CVE-2025-50165
Windows Graphics Component Flaw
Windows Graphics Flaw

Malware (1)

Sturnus

Affected Platform (2)

Microsoft Office
Windows

Tool (4)

Google Chrome
Gflags
Ida
WinDbg

Relationships

Sturnus exploits CVE-2025-50165
Sturnus exploits Windows Graphics Component Flaw
Sturnus exploits Windows Graphics Flaw
Google Chrome exploits CVE-2025-50165
Google Chrome exploits Windows Graphics Component Flaw
Google Chrome exploits Windows Graphics Flaw
Gflags exploits CVE-2025-50165
Gflags exploits Windows Graphics Component Flaw
Gflags exploits Windows Graphics Flaw
Ida exploits CVE-2025-50165
Ida exploits Windows Graphics Component Flaw
Ida exploits Windows Graphics Flaw
WinDbg exploits CVE-2025-50165
WinDbg exploits Windows Graphics Component Flaw
WinDbg exploits Windows Graphics Flaw
CVE-2025-50165 targets Microsoft Office
CVE-2025-50165 targets Windows
Windows Graphics Component Flaw targets Microsoft Office
Windows Graphics Component Flaw targets Windows
Windows Graphics Flaw targets Microsoft Office
Windows Graphics Flaw targets Windows
Sturnus targets Zscaler ThreatLabz
Data Breach targets Microsoft Office
Data Breach targets Windows
Malware targets Microsoft Office
Malware targets Windows
Remote Code Execution targets Microsoft Office
Remote Code Execution targets Windows
Zero-day Exploit targets Microsoft Office
Zero-day Exploit targets Windows
Heap Spraying targets Microsoft Office
Heap Spraying targets Windows
Return-Oriented Programming targets Microsoft Office
Return-Oriented Programming targets Windows

Community

Browse all →

Critical Windows Graphics Vulnerabilities Enable Remote Code Execution

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading