Denial of Fuzzing: Rust in the Windows kernel

Check Point Research (CPR) identified a security vulnerability in the Rust-based kernel component of Windows Graphics Device Interface (GDI) in January 2025, with Microsoft fixing the issue starting with OS Build 26100.4202 in the May 28, 2025 KB5058499 update, a patch that raised the win32kbase_rs.sys file size from 148 KB to 164 KB.

The research highlights that the vulnerability was triggered by a Metafile path in the region_from_path_mut() function within the win32kbase_rs.sys driver, after a crash linked to a NtGdiSelectClipPath syscall and a deliberately mutated EmfPlusDrawBeziers record. CPR reports that Microsoft classified the flaw as moderate-severity, addressing it in a non-security update, though the firm notes that triggering a BSOD via user-space input constitutes a vulnerability requiring a fix.

The publication recounts how CPR’s fuzzing campaign, which started with 16 seed files and used WinAFL-based tooling, ultimately produced a crash after 380,000 mutations and a 30‑minute mutation-to-crash window in a reconfigured harness. CPR also notes that the patch introduces a two-pronged approach to edge handling in region_from_path_mut(), with add_edge_original() and a new, bounds-hardened add_edge_new(), controlled by a feature flag.

According to MSRC, the fix was deployed publicly by late June 2025, with the notable change that the vulnerable component is not present on Windows Server versions.