Security researchers have uncovered a new vulnerability in a Rust-based Windows kernel component that can be triggered remotely to cause a system-wide crash.
The flaw resides within the Windows Graphics Device Interface (GDI) and was discovered by Check Point Research (CPR) during a comprehensive fuzzing campaign.
While this specific bug results in a denial-of-service, it was found alongside other vulnerabilities that could lead to remote code execution, highlighting significant security concerns within core Windows graphics components.
A Fuzzing Campaign’s Unexpected Find
The discovery originated from a research project targeting the Windows GDI subsystem by “fuzzing” Enhanced Metafile Format (EMF) files. Fuzzing is a testing method that involves feeding a program invalid or random data to uncover bugs.
While running their tests, CPR’s systems began to repeatedly crash with a Blue Screen of Death (BSOD). This pointed to a serious flaw not in user-space, but deep within the Windows kernel itself.
Investigation revealed the crash was happening in win32kbase_rs.sys, a new kernel driver written in Rust. Microsoft has been gradually rewriting critical legacy components in memory-safe languages like Rust to improve security.
However, the researchers found that a specially crafted metafile could trigger a kernel panic within this new Rust code. The bug was caused by an out-of-bounds memory access when processing a malformed path in an EmfPlusDrawBeziers record, which Rust’s safety mechanisms correctly caught by deliberately crashing the system.
The Vulnerability and its Impact
While a controlled crash is safer than allowing memory corruption that could lead to code execution, CPR argues that a user-level action causing a kernel panic is a significant denial-of-service vulnerability.
A threat actor could embed a malicious metafile in a document or webpage, and the moment it is rendered, the target system would crash.
region_from_path_mut() function.The researchers developed a proof-of-concept PowerShell script that reliably triggers the BSOD on vulnerable systems, demonstrating that the attack is simple to execute and could be used to disrupt enterprise environments by crashing multiple desktops simultaneously.
- Malicious metafiles can be delivered via email attachments, shared network drives, or embedded in web pages.
- The vulnerability affects both x86 and x64 systems running Windows 11 version 24H2.
- A single compromised low-privilege account can trigger widespread system crashes across an organization.
Microsoft’s Fix and Lingering Concerns
Microsoft addressed the vulnerability in the May 28, 2025, preview update (KB5058499) by restructuring the faulty function and adding a new, bounds-hardened routine for handling edge cases.
This finding, believed to be the first publicly disclosed security issue in a Rust-based Windows kernel component, serves as a critical reminder. While memory-safe languages like Rust prevent entire classes of bugs like buffer overflows, they are not a complete solution.
region_from_path_mut() function.- A new
add_edge_new()routine was introduced alongside the original logic to enforce strict bounds checking. - A feature flag controls whether the hardened code or legacy routine is invoked at runtime.
- Initial testing revealed the feature flag was disabled, delaying the full mitigation until the July 2025 Patch Tuesday.
The incident underscores the immense challenge of modernizing legacy operating system components and the ongoing need for proactive security research.
Even with Rust’s safety guarantees, logical flaws and edge-case behaviors can still introduce serious vulnerabilities, making rigorous testing and thoughtful design indispensable.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
