CVE-2025-53799: Microsoft Windows Imaging Component information disclosure

CVE-2025-53799 · Severity: medium · CVSS 5.5 · Published 2025-09-09

A security vulnerability exists in the Windows Imaging Component, a system tool used by Windows and Office to process and display digital images. An attacker could exploit this flaw to gain access to sensitive information stored in the computer's memory that should otherwise be protected. To carry out the attack, a user would typically need to be tricked into opening a specially crafted file or running a malicious application locally on the device.

Technologies: Microsoft Office, Microsoft Windows 11, Microsoft Windows Server, Microsoft Windows 10. Vendors: Microsoft.

Quick answers

Is CVE-2025-53799 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-53799 being exploited in the wild.
How severe is CVE-2025-53799?
Medium severity, with a CVSS score of 5.5, published 9 September 2025.
Which products and versions are affected?
Microsoft Office Android versions prior to 16.0.19220.20000; Microsoft Windows 11 22H2, 23H2, 24H2; Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2025; Microsoft Windows 10 All versions up to 22H2.
Is there a fix for CVE-2025-53799?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-53799 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-53799?
Check whether you run Microsoft Office, Microsoft Windows 11, Microsoft Windows Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as 'Use of Uninitialized Resource' (CWE-908) exists within the Windows Imaging Component (WIC). The flaw occurs when the component fails to properly initialize memory buffers before use, potentially allowing a local attacker to read the contents of uninitialized memory. Exploitation requires local access and typically involves user interaction, such as convincing a target to open a malicious image file. Successful exploitation results in a loss of confidentiality, as the attacker can disclose sensitive information from the process memory. Microsoft has released security updates to address this issue across affected Windows and Office versions.

Affected products

  • Microsoft Windows 10 All versions up to 22H2
  • Microsoft Windows 11 22H2, 23H2, 24H2
  • Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2025
  • Microsoft Office / 365 Copilot Android versions prior to 16.0.19220.20000

Timeline

  • 2025-09-09: disclosed: Initial disclosure by Microsoft
  • 2025-09-09: advisory: MSRC advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.