CVE-2025-60724

The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft Graphics Component. An attacker can send specially crafted data over the network, causing data to be written outside the bounds of the allocated buffer. As a result of memory overwrite, an attacker may gain control over the process execution flow and execute arbitrary code.

An unauthenticated attacker operating remotely over the network can execute arbitrary code on the vulnerable system, which may lead to complete takeover of the server or workstation, and violation of system confidentiality, integrity, and availability.

Apply patches available from the vendor in accordance with the references (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724). Until the update is installed, it is recommended to limit network exposure of vulnerable systems and monitor network traffic directed to graphics components.

Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows 10 22H2