Windows Rust-based Kernel GDI Vulnerability Leads to Crash and Blue Screen of Death Error

Windows Rust-based Kernel GDI Vulnerability

A vulnerability has been identified in Microsoft’s Rust-based kernel component for the Graphics Device Interface (GDI) in Windows. This flaw can trigger a system crash, commonly known as a Blue Screen of Death (BSOD) , highlighting challenges in integrating memory-safe languages into critical operating system components.

Although Microsoft has classified the vulnerability as moderate in severity, it poses potential risks in enterprise environments where it could be exploited for widespread disruption.

The vulnerability was discovered during a fuzzing campaign by Check Point, which aimed to identify weaknesses in Windows' graphics subsystem. Fuzzing involves sending malformed inputs to software to expose bugs. The researchers utilized tools such as WinAFL and WinAFL Pet, focusing on the Enhanced Metafile Format (EMF) and EMF+ files, which are used for rendering 2D graphics.

The fuzzers revealed various crashes, including information leaks and code execution risks in user-space components. The investigation led to a kernel-level issue, identified as a "Denial of Fuzzing" condition, which halted testing and necessitated a shift to kernel forensics.

Check Point employed memory dump analysis using MemProcFS and Volatility to isolate the issue, eventually identifying a bug in win32kbase_rs.sys , the Rust-rewritten driver for GDI regions. The flaw was triggered by an out-of-bounds array access during path-to-region conversion in NtGdiSelectClipPath , invoking Rust’s panic_bounds_check() and causing a SYSTEM_SERVICE_EXCEPTION .

The issue was caused by a malformed EmfPlusDrawBeziers record with mismatched point counts and abnormal coordinates, using a wide-stroke pen from an EmfPlusObject . A PowerShell proof-of-concept demonstrated the exploit’s accessibility, leading to immediate BSODs from low-privilege sessions on x86/x64 Windows 11 24H2.

Microsoft addressed the vulnerability in OS Build 26100.4202 through the KB5058499 preview update on Mon, May 28, 2025. The update expanded the driver by 16KB and introduced additional logic, including dual edge-handling routines add_edge_original() and a bounds-checked add_edge_new() , controlled by a feature flag. The full rollout occurred in June, with initial testing showing the flag disabled.

Check Point reported the issue, but Microsoft’s MSRC considered it a non-critical denial-of-service threat, arguing that Rust’s panic mechanism functioned as intended. This incident highlights that while Rust can mitigate overflow issues, thorough testing and validation remain crucial to prevent such vulnerabilities.

Based on reporting by Cyber Security News.