CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2025-53766

CVSS 9.8v3.1pub. 2025-08-12upd. 2025-08-14

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

🤖 AI Analysis
How it works

The bug is a heap-based buffer overflow (CWE-122) in the Windows GDI+ library. An attacker sends specially crafted data over the network that causes data to be written beyond the reserved memory area. This can enable overwriting control structures in the process memory and consequently redirect code execution to a malicious payload. The attack requires no authentication or any user interaction.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely (RCE) in the context of the process handling GDI+, which can lead to complete system compromise, loss of confidentiality, integrity, and availability of data.

Mitigation & patch

Patches available from the vendor should be applied immediately in accordance with references published in the Microsoft Security Response Center (MSRC) at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53766

Who is affected

Microsoft Windows 11 22H2, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows Server 2025

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Microsoft Office

    APP
    Microsoft
    < 16.0.14326.22618< 16.0.19127.20000

  • Microsoft Windows 10 1507

    OS
    Microsoft
    < 10.0.10240.21100

  • Microsoft Windows 10 1607

    OS
    Microsoft
    < 10.0.14393.8330

  • Microsoft Windows 10 1809

    OS
    Microsoft
    < 10.0.17763.7678

  • Microsoft Windows 10 21h2

    OS
    Microsoft
    < 10.0.19044.6216

  • Microsoft Windows 10 22h2

    OS
    Microsoft
    < 10.0.19045.6216

  • Microsoft Windows 11 22h2

    OS
    Microsoft
    < 10.0.22621.5768

  • Microsoft Windows 11 23h2

    OS
    Microsoft
    < 10.0.22631.5768

  • Microsoft Windows 11 24h2

    OS
    Microsoft
    < 10.0.26100.4851

  • Microsoft Windows Server 2008

    OS
    Microsoft
    r2

  • Microsoft Windows Server 2012

    OS
    Microsoft
    r2

  • Microsoft Windows Server 2016

    OS
    Microsoft
    < 10.0.14393.8330

  • Microsoft Windows Server 2019

    OS
    Microsoft
    < 10.0.17763.7678

  • Microsoft Windows Server 2022

    OS
    Microsoft
    < 10.0.20348.3989

  • Microsoft Windows Server 2022 23h2

    OS
    Microsoft
    < 10.0.25398.1791

  • Microsoft Windows Server 2025

    OS
    Microsoft
    < 10.0.26100.4851
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Memory
CWE
References

Related vulnerabilities

CVE-2025-59287CRITICAL9.8⚠ KEVPL ✓ten sam produkt

RCE w Windows Server Update Service (WSUS) — deserializacja danych

CVE-2023-23397CRITICAL9.8⚠ KEVten sam produkt

Microsoft Outlook Elevation of Privilege Vulnerability

CVE-2020-1040CRITICAL9.0⚠ KEVten sam produkt

A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly val...

CVE-2020-1350CRITICAL10.0⚠ KEVten sam produkt

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly ...

CVE-2020-0646CRITICAL9.8⚠ KEVten sam produkt

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properl...