Loading vulnerability…
CVE-2025-50165 is a critical remote code execution vulnerability in the Microsoft Graphics Component, specifically affecting Windows image-processing functionality associated with the Windows Imaging Component. The flaw is caused by dereferencing an untrusted pointer during JPEG processing. Available technical analysis indicates the vulnerable condition involves an uninitialized function pointer being invoked in JPEG handling code within the graphics codec path, enabling attacker-influenced control flow under certain conditions. The issue has been associated with JPEG content, including specially crafted images embedded in documents or other files delivered over the network. Microsoft rated the vulnerability critical with a CVSS 3.1 base score of 9.8 and stated that exploitation can allow an unauthorized attacker to execute code over a network without requiring privileges or user interaction.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).
Small two-file repository containing a Python proof-of-concept generator and a detailed README for CVE-2025-50165, a Windows Imaging Component/WindowsCodecs.dll vulnerability. The main exploit logic is in poc_gen.py, which constructs a malformed JPEG beginning with standard JPEG markers, then appends multiple APP1/Exif segments used as a heap-spray vehicle. Each sprayed segment contains a randomized NOP sled, a hardcoded x64 ROP chain with placeholder gadget addresses, embedded shellcode, and marker values such as 0xdeadbeefdeadbeef. The script writes the resulting file to poc/CVE-2025-50165_x64.jpg using PIL/PIF Image.frombytes. The exploit is file-based rather than network-delivered: the generated JPEG must be opened or otherwise processed by a vulnerable WIC host application. The README explains that exploitation occurs not during ordinary decode/view in most cases, but when the host performs JPEG re-encode or thumbnail generation, reaching jpeg_finish_compress and dereferencing uninitialized compress_data_12/compress_data_16 pointers. The intended post-exploitation effect is calc.exe execution, though the code uses hardcoded ROP gadget addresses and appears tailored as a lab PoC rather than a broadly reliable exploit. No command-and-control, remote callback, or external network infrastructure is present in the code. The repository’s purpose is to generate a malicious image for patch validation and vulnerability research against vulnerable Windows 11 24H2 / Windows Server 2025 systems.
This repository provides a working proof-of-concept exploit for CVE-2025-50165, a critical remote code execution vulnerability in the Windows Graphics Component (windowscodecs.dll) on Windows 11 24H2 (prior to patch KB5040442). The exploit is implemented as a single Python script (scripts/generate_poc.py) that generates a weaponized JPEG file (poc/CVE-2025-50165_x64_encrypter15.jpg). The JPEG embeds x64 shellcode (spawns calc.exe), a heap spray, a ROP chain, and a polymorphic NOP sled to evade AV/EDR detection. The exploit requires the target to open the malicious JPEG with a vulnerable application (such as Photos, Office, or Edge preview), after which code execution is achieved with no user interaction or privileges required. The repository is well-documented, with a README describing the vulnerability, usage instructions, and technical details. No external network endpoints are used; the attack vector is a crafted file delivered to the target.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical Windows Graphics remote code execution vulnerability caused by dereferencing an untrusted pointer during processing of specially crafted graphical content such as a malicious JPEG, potentially delivered in an Office document.
A critical remote code execution vulnerability in Windows Imaging Component (WIC) due to dereferencing an uninitialized function pointer during JPEG compression and re-encoding, specifically affecting 12-bit and 16-bit JPEG images.
A vulnerability in Windows Graphics. Details not specified in the content, but it is listed as a serious security flaw for the week.
An untrusted pointer dereference in Windows imaging/JPEG encoding path (windowscodecs.dll, involving jpeg_finish_compress / CJpegTurboFrameEncode::HrWriteSource / CFrameEncodeBase::WriteSource) that can be made user-controlled via heap spraying, enabling instruction pointer control and ROP-based arbitrary code execution when processing a crafted JPEG (e.g., via WIC decoder/encoder WriteSource).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.