CVE-2025-53766
published 2025-08-12CVE-2025-53766: Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
7.18%
93.6th percentile
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | 365_copilot | < 16.0.19127.20000 | 16.0.19127.20000 |
| microsoft | microsoft_office_for_android | >= 16.0.1 < 16.0.19127.20000 | 16.0.19127.20000 |
| microsoft | microsoft_office_for_universal | >= 16.0.1 < 16.0.14326.22618 | 16.0.14326.22618 |
| microsoft | office | < 16.0.14326.22618 | 16.0.14326.22618 |
| microsoft | windows_10_1507 | < 10.0.10240.21100 | 10.0.10240.21100 |
| microsoft | windows_10_1607 | < 10.0.14393.8330 | 10.0.14393.8330 |
| microsoft | windows_10_1809 | < 10.0.17763.7678 | 10.0.17763.7678 |
| microsoft | windows_10_21h2 | < 10.0.19044.6216 | 10.0.19044.6216 |
| microsoft | windows_10_22h2 | < 10.0.19045.6216 | 10.0.19045.6216 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.21100 | 10.0.10240.21100 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.8330 | 10.0.14393.8330 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7678 | 10.0.17763.7678 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.6216 | 10.0.19044.6216 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.6216 | 10.0.19045.6216 |
| microsoft | windows_11_22h2 | < 10.0.22621.5768 | 10.0.22621.5768 |
| microsoft | windows_11_23h2 | < 10.0.22631.5768 | 10.0.22631.5768 |
| microsoft | windows_11_24h2 | < 10.0.26100.4851 | 10.0.26100.4851 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.5768 | 10.0.22621.5768 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.5768 | 10.0.22631.5768 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.5768 | 10.0.22631.5768 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.4946 | 10.0.26100.4946 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27872 | 6.1.7601.27872 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.23471 | 6.0.6003.23471 |
| microsoft | windows_server_2012 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
Type=0x400B (EmfPlusDrawRects record type)
- →Attack vector is network (AV:N) with no privileges required and no user interaction in the worst-case scenario: an attacker uploads a document containing a specially crafted metafile to a web service that parses it. ↗
- →The Preview Pane is NOT an attack vector for CVE-2025-53766; focus detection on document upload/parsing pipelines and web services processing metafiles. ↗
- →The crash/exploitation call stack involves gdiplus!ScanOperation::AlphaDivide_sRGB — monitor for access violations or crashes in this function within GdiPlus.dll as a potential exploitation indicator. ↗
- →Malformed EMF+ files with EmfPlusDrawRects (record type 0x400B) containing oversized or mismatched Count vs. actual RectData entries (e.g., Count=3 but 7 rect entries present) are a structural indicator of exploit attempts. ↗
- ·Exploitation requires the target system or web service to parse a document containing a specially crafted metafile; the vulnerability is in Windows GDI+ (GdiPlus.dll) and affects web services parsing such documents even without user interaction. ↗
- ·As of the MSRC advisory, CVE-2025-53766 has not been publicly disclosed or actively exploited in the wild; exploitability is assessed as 'Exploitation Less Likely'. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v6m7-jpjm-gvwj: Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network
ghsa_unreviewed·2025-08-12
CVE-2025-53766 [CRITICAL] CWE-122 GHSA-v6m7-jpjm-gvwj: Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Microsoft
GDI+ Remote Code Execution Vulnerability
vendor_msrc·2025-08-12·CVSS 9.8
CVE-2025-53766 [CRITICAL] CWE-122 GDI+ Remote Code Execution Vulnerability
GDI+ Remote Code Execution Vulnerability
Description: Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
FAQ: According to the CVSS metric, the privilege required is none (PR:N) and user interaction is none (UI:N). What does that mean for this vulnerability?
An attacker doesn't require any privileges on the systems hosting the web services. Successful exploitation of this vulnerability could cause Remote Code Execution or Information Disclosure on web services that are parsing documents that contain a specially crafted metafile, without the involvement of a victim user.
FAQ: According to the CVSS metric, the attack vector is network (AV:N). How could an attacker exploit the vulnerability?
An attacker could trigger this vulnerabilit
No detection rules found.
No public exploits indexed.
Checkpoint
3rd November – Threat Intelligence Report
blogs_checkpoint·2025-11-03·CVSS 9.8
CVE-2025-61882 [CRITICAL] 3rd November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd November, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The Everest ransomware group has claimed responsibility for a series of attacks impacting AT&T, Dublin Airport, and Air Arabia. The ransomware gang exfiltrated sensitive data including 576,000 AT&T applicant records, 1.5 million Dublin Airport passenger files, and 18,000 Air Arabia employee records. Sweden’s power grid op
Checkpoint
Drawn to Danger: Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure
blogs_checkpoint·2025-11-02·CVSS 7.8
CVE-2025-30388 [HIGH] Drawn to Danger: Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Drawn to Danger: Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure
## Background
GDI
These are the vulnerabilities:
CVE-2025-30388 , rated important an
Checkpoint
18th August – Threat Intelligence Report
blogs_checkpoint·2025-08-18
CVE-2025-30388 18th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 18th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 18th August, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The Canadian House of Commons has suffered a data breach. The incident resulted in unauthorized access to a database containing employees’ names, office locations, email addresses, and information on House-managed computers and mobile devices, reportedly due to vulnerability in Microsoft software.
The Office of the Pennsyl
Krebs
Microsoft Patch Tuesday, August 2025 Edition
blogs_krebs·2025-08-12·CVSS 7.2
CVE-2025-53786 [HIGH] Microsoft Patch Tuesday, August 2025 Edition
Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, meaning they could be abused by malware or malcontents to gain remote access to a Windows system with little or no help from users.
August’s patch batch from Redmond includes an update for CVE-2025-53786 , a vulnerability that allows an attacker to pivot from a compromised Microsoft Exchange Server directly into an organization’s cloud environment, potentially gaining control over Exchange Online and other connected Microsoft Office 365 services. Microsoft first warned about this bug on Aug. 6, saying it affects Exchange Server 2016 and Exchange Server 2019 , as well as its flagship Exchange Serv
Bleepingcomputer
Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
blogs_bleepingcomputer·2025-08-12·CVSS 7.2
[HIGH] Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
## Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
## Lawrence Abrams
44 Elevation of Privilege Vulnerabilities
35 Remote Code Execution Vulnerabilities
18 Information Disclosure Vulnerabilities
4 Denial of Service Vulnerabilities
9 Spoofing Vulnerabilities
When BleepingComputer reports on the Patch Tuesday security updates, we only count those released on Patch Tuesday. Therefore, the number of flaws does not include Mariner, Azure, and Microsoft Edge bugs fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5063878 & KB5063875 cumulative updates and the Windows 10 KB5063709 cumulative update .
## One publicly disclosed zero-day fixed
This month's Patch Tuesday fixes one
Qualys
Microsoft and Adobe Patch Tuesday, August 2025 Security Update Review | Qualys
blogs_qualys·2025-08-12
Microsoft and Adobe Patch Tuesday, August 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for August 2025
- Adobe Patches for August 2025
- Zero-day Vulnerability Patched in August Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- Microsoft July 2025 Patch Tuesday Mitigations
- Qualys Monthly Webinar Series
It’s the second Tuesday of August, and Microsoft has rolled out its latest security updates. Microsoft’s August 2025 Patch Tuesday has arrived, bringing a fresh wave of security fixes to help organizations stay ahead of evolving threats. Here’s a quick breakdown of wh
Talos
Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-08-12·CVSS 7.8
[HIGH] Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for August 2025, which includes 111 vulnerabilities affecting a range of products, including 13 that Microsoft marked as “critical”.
In this month's release, Microsoft observed none of the included vulnerabilities being actively exploited in the wild. Out of 13 "critical" entries, 9 are remote code execution (RCE) vulnerabilities in Microsoft Windows services and applications including the Windows kernel, Microsoft Message Queuing (MSMQ), Windows Hyper-V, Microsoft Office and GDI+.
CVE-2025-50176 is an RCE vulnerability in DirectX Graphics Kernel given a CVSS 3.1 score of 7.8, where access of resource using incompatible type ('type confusion') in Grap
Talos
Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-08-12·CVSS 7.8
[HIGH] Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for August 2025, which includes 111 vulnerabilities affecting a range of products, including 13 that Microsoft marked as “critical”.
In this month's release, Microsoft observed none of the included vulnerabilities being actively exploited in the wild. Out of 13 "critical" entries, 9 are remote code execution (RCE) vulnerabilities in Microsoft Windows services and applications including the Windows kernel, Microsoft Message Queuing (MSMQ), Windows Hyper-V, Microsoft Office and GDI+.
CVE-2025-50176 is an RCE vulnerability in DirectX Graphics Kernel given a CVSS 3.1 score of 7.8, where access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally. Microsoft has noted t
Krebs
Microsoft Patch Tuesday, August 2025 Edition
blogs_krebs·2025-08-12·CVSS 7.2
CVE-2025-53786 [HIGH] Microsoft Patch Tuesday, August 2025 Edition
Microsoft today released updates to fix more than 100 security flaws in its Windows operating systems and other software. At least 13 of the bugs received Microsoft’s most-dire “critical” rating, meaning they could be abused by malware or malcontents to gain remote access to a Windows system with little or no help from users.
August’s patch batch from Redmond includes an update for CVE-2025-53786, a vulnerability that allows an attacker to pivot from a compromised Microsoft Exchange Server directly into an organization’s cloud environment, potentially gaining control over Exchange Online and other connected Microsoft Office 365 services. Microsoft first warned about this bug on Aug. 6, saying it affects Exchange Server 2016 and Exchange Server 2019, as well as its flagship Exchange Server
Qualys
Microsoft and Adobe Patch Tuesday, August 2025 Security Update Review
blogs_qualys·2025-08-12
Microsoft and Adobe Patch Tuesday, August 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for August 2025
Adobe Patches for August 2025
Zero-day Vulnerability Patched in August Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
Microsoft July 2025 Patch Tuesday Mitigations
Qualys Monthly Webinar Series
It’s the second Tuesday of August, and Microsoft has rolled out its latest security updates. Microsoft’s August 2025 Patch Tuesday has arrived, bringing a fresh wave of security fixes to help organizations stay ahead of evolving threats. Here’s a quick breakdown of what you need t
Crowdstrike
August 2025 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] August 2025 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
2025-08-12
Published