Technadu

Windows GDI Vulnerabilities Enable Remote Code Execution and Data Exposure

First seen 4 Nov 2025, 11:09 UTC • Research.Checkpoint

•86% similarity •43.1

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Three vulnerabilities in the Windows Graphics Device Interface (GDI) have been identified, allowing remote code execution (RCE) and information disclosure. Discovered by Check Point Research, these flaws involve malformed Enhanced Metafile (EMF) records and were patched by Microsoft in multiple updates in 2025. The vulnerabilities are tracked as CVE-2025-30388, CVE-2025-53766, and CVE-2025-47984.

ThreatCluster AI

Attack Flow

18 entities, 33 inferred relationships (STIX 2.1).

Technique (5)

Data Breach
Phishing
Ransomware
Supply Chain Attack
Zero-day Exploit

Organization (1)

Check Point

Vulnerability (5)

CVE-2022-35837
CVE-2025-30388
CVE-2025-47984
CVE-2025-49844
CVE-2025-53766

Affected Platform (6)

Android
MacOS
Microsoft Office for Mac
Microsoft Word
Redis
Windows

Threat Actor (1)

Conti

Relationships

Conti uses Data Breach
Conti uses Phishing
Conti uses Ransomware
Conti uses Supply Chain Attack
Conti uses Zero-day Exploit
Conti exploits CVE-2022-35837
Conti exploits CVE-2025-30388
Conti exploits CVE-2025-47984
Conti exploits CVE-2025-49844
Conti exploits CVE-2025-53766
CVE-2022-35837 targets Android
CVE-2022-35837 targets MacOS
CVE-2022-35837 targets Microsoft Office for Mac
CVE-2022-35837 targets Microsoft Word
CVE-2025-30388 targets Android
CVE-2025-30388 targets MacOS
CVE-2025-30388 targets Microsoft Office for Mac
CVE-2025-30388 targets Microsoft Word
CVE-2025-47984 targets Android
CVE-2025-47984 targets MacOS
CVE-2025-47984 targets Microsoft Office for Mac
CVE-2025-47984 targets Microsoft Word
CVE-2025-49844 targets Android
CVE-2025-49844 targets MacOS
CVE-2025-49844 targets Microsoft Office for Mac
CVE-2025-49844 targets Microsoft Word
CVE-2025-53766 targets Android
CVE-2025-53766 targets MacOS
CVE-2025-53766 targets Microsoft Office for Mac
CVE-2025-53766 targets Microsoft Word
Conti targets Check Point
Conti related to Redis
Conti related to Windows

Community

Browse all →

Windows GDI Vulnerabilities Enable Remote Code Execution and Data Exposure

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading