Zscaler ThreatLabz discovered CVE-2025-50165, a critical remote code execution (RCE) vulnerability affecting the Windows Graphics Component with a CVSS score of 9.8.
The flaw exists within windowscodecs.dll, a library leveraged by numerous applications, including Microsoft Office, creating a widespread attack surface across Windows environments.
The vulnerability allows attackers to craft malicious JPEG images that, when processed by any application using windowscodecs.dll, trigger arbitrary code execution.
The attack requires minimal user interaction; simply opening a document containing the malicious image can compromise an entire system.
This low barrier to exploitation makes the vulnerability exceptionally dangerous, as victims may unknowingly download and open weaponized documents.
Technical Details and Exploitation
Security researchers identified the vulnerability through fuzzing of the GpReadOnlyMemoryStream::InitFile function, where an uninitialized memory pointer dereference enables an untrusted function pointer to be called.
By combining heap spraying with Return-Oriented Programming (ROP), attackers can gain control of the instruction pointer and execute arbitrary code.
The exploit leverages the fact that the 32-bit version of windowscodecs.dll runs without Control Flow Guard (CFG) protection by default.
While the 64-bit version requires additional CFG bypass techniques, both architectures remain exploitable.
Microsoft released a patch on August 12, 2025, updating affected Windows versions to build 10.0.26100.4946.
The vulnerability impacts Windows 11 Version 24H2, Windows Server 2025, and Server Core installations.
All users running these versions should immediately apply security updates to remediate the risk. Organizations should prioritize patching across their entire Windows infrastructure.
Given that the Windows Graphics Component is essential to all Windows systems, this vulnerability poses a critical threat that requires urgent remediation.
| Product | Vulnerable Version | Patched Version |
|---|---|---|
| Windows Server 2025 | 10.0.26100.4851 | 10.0.26100.4946 |
| Windows 11 Version 24H2 (x64) | 10.0.26100.4851 | 10.0.26100.4946 |
| Windows 11 Version 24H2 (ARM64) | 10.0.26100.4851 | 10.0.26100.4946 |
| Windows Server 2025 (Server Core) | 10.0.26100.4851 | 10.0.26100.4946 |
With a CVSS score of 9.8, CVE-2025-50165 ranks among the most severe Windows vulnerabilities discovered in 2025.
The combination of universal Windows exposure and ease of exploitation creates an urgent security imperative.
Security teams should treat this as a critical priority and verify patch deployment across all affected systems within 48 hours.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1068,580&ssl=1&description=The flaw exists within windowscodecs.dll, a library leveraged by numerous applications, including Microsoft Office, creating a widespread attack surface across Windows environments.){kind=link}