CVE-2025-21338

High

Published: 14/01/2025(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The GDI+ vulnerability allows for remote code execution, potentially leading to system takeover. An attacker can exploit this flaw through specially crafted images or documents.

Risk Assessment

The risk to the organization involves the potential for remote code execution, which could result in data loss or complete control of the system by unauthorized individuals.

Recommendation

It is recommended to update the software to the latest version to patch this vulnerability and to monitor systems for suspicious activity.

Other vulnerabilities in GDI+

CVE-2021-34440Medium
Information disclosure vulnerability in GDI+ on Windows. It may allow an attacker to access data that should be protected.

Original NVD description (English source)

GDI+ Remote Code Execution Vulnerability

Vulnerability data from NVD (NIST) · CISA KEV · EPSS