Windows GDI Vulnerability in Rust Kernel Module Enables Remote Attacks

A newly discovered flaw in Microsoft’s Rust-based Graphics Device Interface (GDI) kernel component allows unprivileged attackers to crash or take control of Windows systems, according to GBHackers. Check Point Research uncovered the issue in January 2025 and reported it to Microsoft, with Microsoft addressing the bug in the 28 May 2025 KB5058499 preview update (OS Build 26100.4202) and a full rollout by late June.

Metafile fuzzing revealed a kernel panic when the bug manifested in the win32kbase_rs.sys driver during a NtGdiSelectClipPath call, caused by a bounds-check failure in region_from_path_mut() when EMF+ Bezier records declared four points but supplied seventeen. Investigators used WinAFL Pet and BugId to manage fuzzing and crash analysis, and CPR produced a proof-of-concept PowerShell script that could crash desktops or servers from a low-integrity account.

Microsoft classified the flaw as moderate severity “denial of service” and issued a patch via non-security updates in June 2025, with Rust’s memory safety preventing silent data corruption but causing a crash instead. The article notes this incident is likely the first public security flaw in Windows’ Rust kernel modules, underscoring the need for rigorous testing alongside language safety guarantees.