Skip to content
Windows GDI Vulnerabilities Enable Remote Code Execution and Data Exposure

Windows GDI Vulnerabilities Enable Remote Code Execution and Data Exposure

First seen 4 Nov 2025, 11:09 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

Three vulnerabilities in the Windows Graphics Device Interface (GDI) have been identified, allowing remote code execution (RCE) and information disclosure. Discovered by Check Point Research, these flaws involve malformed Enhanced Metafile (EMF) records and were patched by Microsoft in multiple updates in 2025. The vulnerabilities are tracked as CVE-2025-30388, CVE-2025-53766, and CVE-2025-47984.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 224d ago How this analysis works

More articles in this cluster (4)

Following this threat?

Track Conti, Check Point and CVE-2022-35837 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed