Windows GDI Vulnerability in Rust Kernel Module Enables Remote Attacks
A vulnerability has been identified in Microsoft's Rust-based Graphics Device Interface (GDI) kernel component, allowing unprivileged attackers to crash or take control of Windows systems.
A vulnerability has been identified in Microsoft's Rust-based Graphics Device Interface (GDI) kernel component, allowing unprivileged attackers to crash or take control of Windows systems.
Check Point Research (CPR) discovered the issue in January 2025 and reported it to Microsoft. The company addressed the vulnerability with the May 28, 2025 KB5058499 preview update (OS Build 26100.4202), with a complete rollout by late June.
Metafile Fuzzing Uncovers Kernel Panic
CPR initiated a fuzzing campaign targeting Windows metafiles, using the technique to inject random or malformed data into software to identify weaknesses. They employed WinAFL Pet and BugId for managing fuzzing jobs and analyzing crashes, focusing on the Enhanced Metafile Format (EMF) and its EMF+ variant. After initial tests resulted in user-space crashes, the machines unexpectedly rebooted due to a kernel BugCheck.
Researchers captured memory dumps and extracted mutated seed files from RAM disks using MemProcFS. By replaying these samples in a single-instance fuzz setup, they consistently reproduced the crash in under 30 minutes after approximately 380,000 mutations of 836 seed files.
The crash occurred in the Rust-based win32kbase_rs.sys driver during a NtGdiSelectClipPath syscall. A bounds check in the region_from_path_mut() function failed when malformed path data caused out-of-bounds array access. This faulty logic arose when EMF+ Bezier curve records declared four points but supplied seventeen, resulting in edge block list overflow and triggering a Blue Screen of Death (BSOD).
Check Point Research (CPR) discovered the issue in January 2025 and reported it to Microsoft.
CPR developed a proof-of-concept PowerShell script that loads a specially crafted metafile via Graphics::FromImage() and DrawImage(). From a low-integrity account, an attacker could repeatedly crash desktops or servers, potentially causing data loss and operational downtime.
Microsoft’s Fix and Security Assessment
Microsoft rated the flaw as moderate severity for "denial of service" and addressed it through non-security updates in June 2025. Analysis of win32kbase_rs.sys file sizes showed an increase from 148 KB to 164 KB, indicating enhanced bounds checks.
The update introduced dual edge-handling routines, add_edge_original() and add_edge_new(), with runtime feature flags to select the safe path. While the patch existed in preview, the flag remained disabled until production. Security researchers argue that any user-controlled input leading to a BSOD should be treated as a vulnerability.
Rust’s memory safety prevented silent data corruption but defaulted to a crash. A more robust design would handle out-of-bounds conditions gracefully without halting the entire system.
This incident highlights that while Rust offers strong safety guarantees, rigorous testing and design principles remain essential. As more Rust code integrates into critical systems, developers must maintain high engineering standards and anticipate subtle edge cases to prevent disruptions.
Based on reporting by GBHackers.