Microsoft Windows GDI Untrusted Search Path Vulnerability Allowing Local Remote Code Execution

A vulnerability exists in the Windows Graphics Device Interface (GDI) due to an untrusted search path, which allows an unauthorized attacker to execute code locally. Exploitation involves convincing a user to run a specially crafted installer from an untrusted directory, which can lead to the execution of malicious code by exploiting unsafe dependency loading in the GDI.

Impact

Exploitation of this vulnerability could result in remote code execution on the affected system.

Reproduction

To reproduce this vulnerability, a user must be convinced to download and execute an installer from an untrusted directory. Once the installer is run, Windows may load a malicious dynamic link library (DLL) because of the untrusted search path, allowing the attacker to execute arbitrary code on the system.

Remediation

Users can apply the security update KB5078885 for Windows 10, KB5078766 for Windows Server 2022, and KB5078752 for Windows Server 2019. For Windows 11, the security update KB5079466 is available for versions 26H1, 24H2, and 25H2. Windows Server 2016 users can also apply the security update KB5078938.