Security experts are warning about a newly discovered series of vulnerabilities in the graphics components of Microsoft Windows that could be exploited by an attacker to take control of affected systems, execute remote code, and access sensitive memory data. The vulnerabilities, which impact the Win32k Graphics component, were discovered by Checkpoint researchers and published in a joint advisory with CyberSecurityNews. If successfully exploited, these flaws could enable attackers to remotely take control of impacted devices without the need for user credentials or authorization.
Where is the weakness, and why is it a risk?
They are located in core Windows parts that are part of just about every application that dynamically renders graphics, making them a valuable target for attackers.
The vulnerabilities have to do with how Windows processes graphics formats, Enhanced Metafile (EMF) and Windows Metafile (WMF) – legacy graphics formats for storing image data, according to Check Point research. These are operated by the GDI (Graphics Device Interface) subsystem, which is part of the Win OS.
Developers found that malformed EMF or WMF files could cause memory corruption and buffer overflows, which can result in remote code execution (RCE). In one such proof-of-concept, attackers would have been able to disguise malicious graphics files as documents or web content, and when a recipient at the other end opened it they compromised their computer without them even knowing.
Memory exposure and privilege escalation
In addition to remote code execution issues, the vulnerabilities also disclose sensitive memory areas, which could be exploited by an attacker to leak kernel memory and escalate privileges. This could allow attackers to thus spread from computer to computer network or deploy such security tools.
Eyal Itkin at CheckPoint says:
“These specific vulnerabilities are particularly concerning because the only user interaction that is needed to trigger them is opening a file or browsing to a webpage. This makes them excellent to be used in phishing campaigns or drive-by downloads.”
Microsoft is aware of the issues and is developing fixes, which will be released as part of next month’s Patch Tuesday cycle. Meanwhile, security pros advise disabling EMF/WMF rendering in untrusted software and using endpoint protection tools capable of recognizing odd behavior with graphics files.
CheckPoint has also published rules for companies to look for signs that they were under attack
According to CybersecurityNews, the flaw exists in various versions of Windows, including Windows 10 and some editions of Windows 11 and Windows server, so attackers could have a field day with this exploit.
CheckPoint published IOCs and YARA rules for companies to see signs of attack.
These vulnerabilities remind us of the continued threats from legacy components in new operating systems. Although the use of EMF (and EMF) file formats is no longer in practice, they are still supported due to backward compatibility reasons, and thus independent libraries often handle them properly.
For businesses, the vulnerabilities highlight the need for application hardening, sandboxing, and zero-trust architectures. We recommend organizations audit their environment for exposure to these formats and educate users on the risks of opening documents or links from unknown or untrusted sources.
A wake-up call for IT and security teams
Even as assailants evolve their attack methods, the foundation of a lot of these components (like Windows graphics subsystems) will continue to be juicy targets.
In the meantime, the bugs are a powerful lesson for keeping in mind that security must be proactive rather than reactive.
Microsoft’s updates are currently pending. It is now recommended that organizations to be ready to apply patches urgently and watch out for signs of exploitation. For now, vigilance and a strong defense system continue to be the best guard against these attacks.
