CVE-2025-53766: GDI+ Remote Code Execution Vulnerability

CVE-2025-53766 is a remote code execution vulnerability in GDI+, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 11.52% probability of exploitation activity in the next 30 days, higher than 96% of all scored vulnerabilities. Microsoft released the fix on 12 August 2025 in the August 2025 Patch Tuesday, delivered through 16 security updates (KB5063877, KB5063880, KB5063812, KB5063709 and more). It affects 39 products in 3 product families (Windows, ESU, Microsoft Office).

Key facts

CVE ID

CVE-2025-53766

Severity

Critical CVSS 9.8

Microsoft severity

Critical

Impact

Remote Code Execution

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

Weakness

CWE-122

EPSS

11.52% (percentile 96%)

CISA KEV

Not listed

Released

12 August 2025

Last updated

12 August 2025

Patch Tuesday

August 2025 Patch Tuesday

Product families

Windows, ESU, Microsoft Office

CVSS score and vector

Microsoft scores CVE-2025-53766 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Description

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

Frequently asked questions (Microsoft)

According to the CVSS metric, the privilege required is none (PR:N) and user interaction is none (UI:N). What does that mean for this vulnerability?

An attacker doesn't require any privileges on the systems hosting the web services. Successful exploitation of this vulnerability could cause Remote Code Execution or Information Disclosure on web services that are parsing documents that contain a specially crafted metafile, without the involvement of a victim user.

According to the CVSS metric, the attack vector is network (AV:N). How could an attacker exploit the vulnerability?

An attacker could trigger this vulnerability by convincing a victim to download and open a document that contains a specially crafted metafile. In the worst-case scenario, an attacker could trigger this vulnerability on web services by uploading documents containing a specially crafted metafile (AV:N) without user interaction. When multiple attack vectors can be used, we assign a score based on the scenario with the higher risk.

Is the Preview Pane an attack vector for this vulnerability?

No, the Preview Pane is not an attack vector.

Affected products (39)

Windows

ESU

Microsoft Office

Security updates (16)

• KB5063877 (Security Update)
• KB5063880 (Security Update)
• KB5063812 (SecurityHotpatchUpdate)
• KB5063709 (Security Update)
• KB5063875 (Security Update)
• KB5063878 (Security Update)
• KB5064010 (SecurityHotpatchUpdate)
• KB5063899 (Security Update)
• KB5063889 (Security Update)
• KB5063871 (Security Update)
• KB5063888 (Monthly Rollup)
• KB5063948 (Security Only)
• KB5063947 (Monthly Rollup)
• KB5063927 (Security Only)
• KB5063906 (Monthly Rollup)
• KB5063950 (Monthly Rollup)

NIST NVD data

NVD status

Analyzed

NVD CVSS

9.8 (CRITICAL)

NVD weakness

CWE-122

Published to NVD

12 August 2025

NVD last modified

22 May 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53766 (Vendor Advisory)

Acknowledgments

• Gábor Selján with Check Point Research

Revision history

Related vulnerabilities

Other GDI+ vulnerabilities

• CVE-2026-25181: GDI+ Information Disclosure Vulnerability (High, CVSS 7.5, March 2026)
• CVE-2026-20846: GDI+ Denial of Service Vulnerability (High, CVSS 7.5, February 2026)
• CVE-2021-34440: GDI+ Information Disclosure Vulnerability (Medium, CVSS 5.5, July 2021)
• CVE-2021-1665: GDI+ Remote Code Execution Vulnerability (High, CVSS 7.8, January 2021)
• CVE-2020-16911: GDI+ Remote Code Execution Vulnerability (High, CVSS 8.8, October 2020)
• CVE-2020-1285: GDI+ Remote Code Execution Vulnerability (High, CVSS 8.4, September 2020)
• CVE-2020-1435: GDI+ Remote Code Execution Vulnerability (Medium, CVSS 6.3, July 2020)
• CVE-2020-1248: GDI+ Remote Code Execution Vulnerability (High, CVSS 8.4, June 2020)
• CVE-2020-0964: GDI+ Remote Code Execution Vulnerability (High, CVSS 8, April 2020)
• CVE-2020-0883: GDI+ Remote Code Execution Vulnerability (Medium, CVSS 6.7, March 2020)
• CVE-2020-0881: GDI+ Remote Code Execution Vulnerability (Medium, CVSS 6.7, March 2020)

More from the August 2025 Patch Tuesday

• CVE-2025-53779: Windows Kerberos Elevation of Privilege Vulnerability (High, CVSS 7.2)
• CVE-2025-50165: Windows Graphics Component Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2025-50171: Remote Desktop Spoofing Vulnerability (Critical, CVSS 9.1)
• CVE-2025-53778: Windows NTLM Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2025-50177: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (High, CVSS 8.1)
• CVE-2025-53786: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability (High, CVSS 8)
• CVE-2025-50168: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2025-53132: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2025-50167: Windows Hyper-V Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2025-53147: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2025-49743: Windows Graphics Component Elevation of Privilege Vulnerability (Medium, CVSS 6.7)
• CVE-2025-53156: Windows Storage Port Driver Information Disclosure Vulnerability (Medium, CVSS 5.5)

All vulnerabilities of this release: August 2025 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2025-53766
• NIST NVD: CVE-2025-53766
• CVE.org record: CVE-2025-53766