CVE-2025-50165

The vulnerability is based on untrusted pointer dereference (CWE-822) combined with the use of uninitialized memory (CWE-908) in Microsoft Graphics Component. An attacker can deliver specially crafted input data over the network, which causes the graphics component to read or execute code from a pointer controlled by the attacker. The lack of authentication requirement and user interaction allows for complete remote exploitation of the vulnerability without any prior access conditions.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely in the context of the affected system, which may lead to complete system compromise, violation of data confidentiality, integrity, and availability.

Apply patches available from the vendor according to the references. Update details are available in the Microsoft Security Response Center at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50165

Microsoft Windows 11 24H2 and Microsoft Windows Server 2025