Loading story…
A critical vulnerability, CVE-2025-50165, was discovered in the Windows Imaging Component (WIC), specifically within the WindowsCodecs.dll library. The flaw arises from the dereferencing of an uninitialized function pointer during the compression and re-encoding of JPEG images with 12-bit or 16-bit color depth, rather than during standard image decoding or rendering. Security researchers from ESET and Zscaler have analyzed the vulnerability, confirming that it could potentially allow remote code execution if a specially crafted JPEG file is processed by a vulnerable application that performs re-encoding, such as during thumbnail creation.
Despite the initial classification as a critical remote code execution risk, further technical analysis indicates that real-world exploitation is significantly constrained. Successful exploitation requires a precise set of conditions: the target application must use a vulnerable version of WindowsCodecs.dll and must re-encode, not just display, a malicious JPEG file. Simply opening or viewing a crafted image is insufficient to trigger the vulnerability, reducing the likelihood of mass exploitation. Microsoft has released a patch, and security experts recommend applying it, but the practical risk is lower than originally feared due to the complexity of the attack scenario.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Follow-on coverage summarized that CVE-2025-50165 could enable remote code execution only in complex attack scenarios, not through ordinary image viewing or decoding. The reporting emphasized patching systems that process untrusted image files.
ESET published research revisiting the Windows Imaging Component flaw, explaining that exploitation would require re-encoding non-standard JPEGs plus significant heap manipulation and address leakage. Its analysis supported Microsoft's view that widespread real-world exploitation was unlikely.
Microsoft issued fixes for CVE-2025-50165 in Windows Imaging Component, addressing a remote code execution risk tied to WindowsCodecs.dll. The remediation aligned with upstream fixes in libjpeg-turbo 3.1.1.
Windows Imaging Component installations using WindowsCodecs.dll versions 10.0.26100.0 through 10.0.26100.4945 were affected by CVE-2025-50165, a flaw in JPEG compression or re-encoding logic involving uninitialized function pointers. The issue affected handling of specially crafted 12-bit or 16-bit JPEG files under complex conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates addressing 56 vulnerabilities across its Windows platform, including a critical use-after-free flaw in the Windows Cloud Files Mini Filter Driver (CVE-2025-62221) that has been actively exploited in the wild. This vulnerability allows local attackers to escalate privileges to SYSTEM level, posing a significant risk to Windows systems, especially those using cloud storage features like OneDrive, Google Drive, or iCloud. The December 2025 Patch Tuesday also included fixes for other critical and important vulnerabilities, with Microsoft having patched over 1,000 CVEs for the second consecutive year. CISA has added both CVE-2025-62221 and CVE-2025-5618 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting their active exploitation and the urgent need for remediation. CVE-2025-5618 is a directory traversal remote code execution vulnerability in WinRAR, allowing attackers to craft malicious archives that bypass directory restrictions and execute arbitrary code upon extraction. Both vulnerabilities are being leveraged in real-world attacks, prompting federal agencies and organizations to prioritize patching to prevent persistence, lateral movement, and data exfiltration by threat actors.
Jun 29, 2026
XBOW disclosed three **critical** Microsoft remote code execution flaws, including two in **Bing Images** and one in the **Microsoft Devices Pricing Program**, after reporting them through coordinated vulnerability disclosure. The issues are identified as `CVE-2026-32194`, `CVE-2026-32191`, and `CVE-2026-21536`, and XBOW said Microsoft rated all three **CVSS 9.8**. According to the disclosure, the two Bing Images bugs were reachable over the network **without authentication or user interaction** and stemmed from attacker-controlled **SVG** content being passed into a backend image-processing pipeline where command injection became possible. XBOW said its research began with a blind **SSRF** in reverse image search and expanded into parser and renderer testing that pointed to an **ImageMagick** or ImageMagick-compatible delegate-backed conversion path. The company reported benign out-of-band proof-of-execution from production Bing image-processing workers, including **Windows Server 2022** systems running commands as **`NT AUTHORITY\SYSTEM`** and Linux workers returning **`uid=0/gid=0`**. The third flaw, `CVE-2026-21536`, reportedly allowed unrestricted upload of server-executable files in the Microsoft Devices Pricing Program, underscoring how image converters, delegates, and upload handlers can become high-impact execution points when exposed to untrusted content.
Jul 24, 2026
Microsoft published multiple security advisories for **Windows**, **Azure**, and **developer tooling**, including several high-impact issues spanning **remote code execution (RCE)**, **elevation of privilege (EoP)**, **spoofing**, **information disclosure**, **denial of service**, and **security feature bypass**. Notable items include **Azure SDK for Python RCE** `CVE-2026-21531` (CVSS 9.8; **deserialization of untrusted data**), **Windows Shell security feature bypass** `CVE-2026-21510` (CVSS 8.8; exploitability listed as **E:F**), **GitHub Copilot/Visual Studio/VS Code** issues enabling **RCE/EoP/feature bypass** (`CVE-2026-21256`, `CVE-2026-21523`, `CVE-2026-21257`, `CVE-2026-21518`), and **Azure Local RCE** `CVE-2026-21228` (CVSS 8.1; **improper certificate validation**). Additional Windows platform flaws include **Desktop Window Manager EoP** `CVE-2026-21519` (type confusion), **HTTP.sys EoP** `CVE-2026-21232` (untrusted pointer dereference), **WinSock Ancillary Function Driver EoP** `CVE-2026-21238` (improper access control), **Windows Storage EoP** `CVE-2026-21508`, **WSL EoP** `CVE-2026-21237`, **Microsoft Word security feature bypass** `CVE-2026-21514`, **Outlook spoofing** `CVE-2026-21511`, **Windows LDAP DoS** `CVE-2026-21243`, plus **ACI Confidential Containers information disclosure** `CVE-2026-23655` and **Azure IoT Explorer information disclosure** `CVE-2026-21528`. Separately, a detailed third-party writeup described a **Windows Error Reporting Service** local privilege escalation, `CVE-2026-20817`, patched in January 2026, where the **WER service** (`wersvc.dll`) running as `NT AUTHORITY\SYSTEM` allegedly fails to validate requester permissions over **ALPC**, enabling a standard user to trigger process creation with a SYSTEM-derived token (retaining powerful rights such as *SeDebugPrivilege*, *SeImpersonatePrivilege*, and *SeBackupPrivilege*). Another third-party report highlighted a long-standing **libpng** heap buffer issue, `CVE-2026-25646` (CVSS 8.3), in `png_set_quantize()` that can be triggered by a crafted PNG (palette present, histogram absent) leading to an infinite loop/out-of-bounds read with potential for DoS and, with heap grooming, possible code execution; an additional MSRC entry referenced **libjpeg-turbo** `CVE-2023-2804` (heap-based overflow) as an Important RCE-class issue. Collectively, the disclosures reinforce the need to prioritize patching for internet-reachable components and developer tooling, and to treat local EoP bugs as high-risk in post-compromise and lateral movement scenarios.
Jun 29, 2026