Telegram-канал malwarenews - Malware News: Unsorted

Malware News

17 December 2025 14:10

Our chat was blocked
Join our new chat and invite your friends.

t.me/MalwareForums

Malware News

02 November 2025 16:34

‌Drawn to Danger: Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure

Background

Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Check Point Research (CPR) identified three security vulnerabilities in the Graphics Device Interface (GDI) in Windows. We promptly reported these issues to Microsoft, and they were addressed in the Patch Tuesday updates in May, July, and August 2025.

These are the vulnerabilities:

— CVE-2025-30388, rated important and considered more likely to be exploited;
— CVE-2025-53766, classified as critical severity and may allow remote attackers to execute arbitrary code on affected systems;
— CVE-2025-47984, also rated important and can result in the unauthorized disclosure of sensitive information over the network.

Vulnerability disclosures such as these highlight the need for proactive measures to mitigate potential risks. Our purpose in publishing this blog after security fixes were implemented is to further raise awareness of these vulnerabilities and provide Windows users with defensive insights and mitigation recommendations. In the following sections, we detail the findings of our fuzzing campaign, which targeted Windows GDI using the EMF format and led to the discovery of these security vulnerabilities.

Geometry Gone Rogue – CVE-2025-30388
We found three separate crashes related to the processing of EmfPlusDrawString, EmfPlusFillRects and EmfPlusFillClosedCurve records. All three cases have a common root cause: another record sets the stage for exploitation. However, the outcome varies depending on which additional records are processed during the execution. Our current analysis focuses on the crash involving the EmfPlusDrawString record.

Multiple access violation exceptions occurred in the ScanOperation::AlphaMultiply_sRGB(), ScanOperation::Blend_sRGB_sRGB_MMX() and EpAntialiasedFiller::OutputSpan() functions within version 10.0.26100.3037 of the GdiPlus.dll module. These exceptions were triggered when the system attempted to read or write memory at the end of a 4000/0xFA0 bytes heap block, or while attempting to access reserved but unallocated memory.

This vulnerability could potentially allow a remote attacker to perform out-of-bounds read or write memory operations using a specially crafted EMF+ metafile. Figure 1 shows the decompiled source code of the ScanOperation::AlphaMultiply_sRGB() function at the time of the crash.

Figure 1. Decompiled source code of the affected ScanOperation::AlphaMultiply_sRGB() function.

In our crash sample, which serves as a proof of concept (PoC) for reproducing a vulnerability, an EmfPlusClear record is located before the EmfPlusDrawString record within the metafile. This record clears the output coordinate space and initializes it with a background color and transparency, as defined by its Color field. The field contains an EmfPlusARGB object specifying red, green, blue, and alpha components. This detail is significant because it allows an attacker to control the value written to memory during exploitation. Listing 1 shows the affected EmfPlusClear record.

EmfPlusClear clear = {
.Type = 0x4009,
.Flags = 0x0102,
.Size = 0x0000003c,
.DataSize = 0x00000030,
.Color = 0xaabbccff // Value written to memory
};

Listing 1. Sample EmfPlusClear record showing the value written to memory.

Further investigation revealed that the EmfPlusClear record handler uses the EpScanBitmap::Start() function to allocate a heap block to store 4000 bytes (0xFA0). This buffer is then populated with the specified EmfPlusARGB object, which...

https://malware.news/t/drawn-to-danger-windows-graphics-vulnerabilities-lead-to-remote-code-execution-and-memory-exposure/100917
https://malware.news/latest.rss

Project: @MalwareNews
Private: @MalwarePrivateBot
Group: @MalwareForums
Powered by @MalwareForum