CVE-2025-53766
CriticalSummary
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Risk Assessment
An attacker can remotely take control of the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update the operating system and monitor network activity to detect potential attacks.
Other vulnerabilities in Windows GDI+
See all- CVE-2026-35421High
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.
- CVE-2026-50380Critical
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2020-1179Medium
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
- CVE-2020-0963Medium
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
- CVE-2019-0903HighActively exploited
A remote code execution vulnerability in the Windows GDI+ interface, caused by improper handling of objects in memory. An attacker could exploit this to execute arbitrary code remotely.
- CVE-2026-85797Medium
An out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
- CVE-2026-83934High
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2026-83929High
Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
- CVE-2026-83860High
Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.
- CVE-2026-83651Medium
Out-of-bounds read vulnerability in Windows GDI allows an unauthorized attacker to disclose information over a network.
Original NVD description (English source)
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS