PT-2025-46485 · Microsoft · Graphics+1

Published 2025-11-11 · Updated 2026-05-22 · CVE-2025-60724

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Graphics Component (affected versions not specified) Windows OS (affected versions not specified) Microsoft Office (affected versions not specified) Azure (affected versions not specified) SQL Server (affected versions not specified)

Description A heap-based buffer overflow exists in the Microsoft Graphics Component, specifically within the Windows GDI+ interface. A heap-based buffer overflow occurs when a program writes more data to a heap-allocated memory block than it can hold, potentially corrupting adjacent memory. This flaw allows an unauthenticated remote attacker to execute arbitrary code over a network, which could lead to full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2025-14172

CVE-2025-60724

Affected Products

Graphics

Windows

References · 28

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14172 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-60724 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-60724 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-60724 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60724 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/726474 · Security Note
• https://twitter.com/CveTodo/status/1988322157349286292 · Twitter Post
• https://twitter.com/cybernewslive/status/1988502385556086986 · Twitter Post
• https://twitter.com/ArjunGU2/status/1988433962180780417 · Twitter Post
• https://t.me/true_secator/7617 · Telegram Post
• https://reddit.com/r/DefenceProfessionals/comments/1oyrzew/certin_issues_urgent_alert_for_microsoft_users_on · Reddit Post
• https://t.me/purp_sec/1280 · Telegram Post
• https://twitter.com/CyberDailyPost/status/1989327496819494994 · Twitter Post
• https://twitter.com/windowsforum/status/1990544862022619161 · Twitter Post