A series of vulnerabilities within the Windows Graphics Device Interface (GDI) has been discovered, potentially allowing for remote code execution and information disclosure. These vulnerabilities are linked to malformed enhanced metafile (EMF) and EMF+ records, leading to memory corruption during image rendering. Three specific vulnerabilities were analyzed and included in Microsoft's Patch Tuesday updates released in May, July, and August of 2025. They are cataloged as:
- CVE-2025-30388: Rated important and more likely to be exploited.
- CVE-2025-53766: Rated critical, enabling remote code execution.
- CVE-2025-47984: Rated important, associated with information disclosure.
All three involve out-of-bounds memory access triggered by crafted metafiles. Microsoft has released patches for GdiPlus.dll and gdi32full.dll to address these vulnerabilities, including validation checks and corrections in memory handling. These vulnerabilities also affect Microsoft Office for Mac and Android platforms.