Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
The vulnerability is based on untrusted pointer dereference (CWE-822) combined with the use of uninitialized memory (CWE-908) in Microsoft Graphics Component. An attacker can deliver specially crafted input data over the network, which causes the graphics component to read or execute code from a pointer controlled by the attacker. The lack of authentication requirement and user interaction allows for complete remote exploitation of the vulnerability without any prior access conditions.
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely in the context of the affected system, which may lead to complete system compromise, violation of data confidentiality, integrity, and availability.
Apply patches available from the vendor according to the references. Update details are available in the Microsoft Security Response Center at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50165
Microsoft Windows 11 24H2 and Microsoft Windows Server 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMicrosoft Windows 11 24h2
OSMicrosoft< 10.0.26100.4851Microsoft Windows Server 2025
OSMicrosoft< 10.0.26100.4851
Related vulnerabilities
Double free w Windows IKE Extension umożliwia zdalne wykonanie kodu
RCE w Windows Server Update Service (WSUS) — deserializacja danych
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.