Technadu

Windows GDI Vulnerabilities Enable Remote Code Execution and Data Exposure

First seen 4 Nov 2025, 11:09 UTC • Research.Checkpoint

•43.1

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Three vulnerabilities in the Windows Graphics Device Interface (GDI) have been identified, allowing remote code execution (RCE) and information disclosure. Discovered by Check Point Research, these flaws involve malformed Enhanced Metafile (EMF) records and were patched by Microsoft in multiple updates in 2025. The vulnerabilities are tracked as CVE-2025-30388, CVE-2025-53766, and CVE-2025-47984.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

18 entities, 33 inferred relationships (STIX 2.1).

Technique (5)

Data Breach
Phishing
Ransomware
Supply Chain Attack
Zero-day Exploit

Organization (1)

Check Point

Vulnerability (5)

CVE-2022-35837
CVE-2025-30388
CVE-2025-47984
CVE-2025-49844
CVE-2025-53766

Affected Platform (6)

Android
MacOS
Microsoft Office for Mac
Microsoft Word
Redis
Windows

Threat Actor (1)

Conti

Relationships

Conti uses Data Breach
Conti uses Phishing
Conti uses Ransomware
Conti uses Supply Chain Attack
Conti uses Zero-day Exploit
Conti exploits CVE-2022-35837
Conti exploits CVE-2025-30388
Conti exploits CVE-2025-47984
Conti exploits CVE-2025-49844
Conti exploits CVE-2025-53766
CVE-2022-35837 targets Android
CVE-2022-35837 targets MacOS
CVE-2022-35837 targets Microsoft Office for Mac
CVE-2022-35837 targets Microsoft Word
CVE-2025-30388 targets Android
CVE-2025-30388 targets MacOS
CVE-2025-30388 targets Microsoft Office for Mac
CVE-2025-30388 targets Microsoft Word
CVE-2025-47984 targets Android
CVE-2025-47984 targets MacOS
CVE-2025-47984 targets Microsoft Office for Mac
CVE-2025-47984 targets Microsoft Word
CVE-2025-49844 targets Android
CVE-2025-49844 targets MacOS
CVE-2025-49844 targets Microsoft Office for Mac
CVE-2025-49844 targets Microsoft Word
CVE-2025-53766 targets Android
CVE-2025-53766 targets MacOS
CVE-2025-53766 targets Microsoft Office for Mac
CVE-2025-53766 targets Microsoft Word
Conti targets Check Point
Conti related to Redis
Conti related to Windows

Continue Reading

Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million EU Sanctions Russia Over Ongoing Cyber Espionage Campaign EU Sanctions Vitaly Kovalev, Ransomware Leader of Trickbot Group $15M Grinex Cyberattack Halts Operations Amid Allegations of Foreign Intelligence Involvement Conti Ransomware Group's Internal Messages Leaked Amid Ukraine Conflict Critical RCE Vulnerability in Veeam Backup Exposes Organizations to Attacks

Windows GDI Vulnerabilities Enable Remote Code Execution and Data Exposure

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading