CVE-2025-60724CWE-122

GDI+ Remote Code Execution Vulnerability

Critical · published November 11, 2025

CVSS v3.1
9.8
EPSS
6%
Percentile
93.6
In the wild
Unconfirmed
What it is

🔥 A heap-based buffer overflow in the Microsoft Graphics Component makes it frighteningly easy for attackers to execute arbitrary code over the network! Think of it as a delivery driver who can access any locked room in a high-security building just by claiming they have a package — all it takes is one loophole in the system! If exploited, this vulnerability could allow an unauthorized attacker to gain full control over affected systems, leading to potential data theft, loss of sensitive information, or even complete system compromise. The consequences could be absolutely devastating, especially for organizations relying on Microsoft graphics technologies!

Put simply

Think of it as a delivery driver who can access any locked room in a high-security building just by claiming they have a package — all it takes is one loophole in the system! This vulnerability arises from incorrect handling of memory in the Microsoft Graphics Component, allowing attackers to overwrite the heap and execute malicious code remotely, with potentially severe implications for system security.

What to do

If exploited, this vulnerability could allow an unauthorized attacker to gain full control over affected systems, leading to potential data theft, loss of sensitive information, or even complete system compromise. The consequences could be absolutely devastating, especially for organizations relying on Microsoft graphics technologies! Immediate action is required! Update to the latest version of the Microsoft Graphics Component to patch this vulnerability and ensure your systems are fortified against possible attacks. Regularly review your security protocols and monitor for any suspicious activity. You've got this! With prompt action, you can protect your systems like a true security hero! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.06290 · 93.6th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-11-11T17:59Z
EPSS history
Timeline
  • 11 NOV 17:59Z
    GDI+ Remote Code Execution Vulnerability
    cvelistv5