Microsoft has acknowledged a new information-disclosure vulnerability in the Windows DirectX graphics component that could let attackers read sensitive data from a system’s memory. The flaw, tagged CVE-2025-64670, was patched in the company’s latest security updates and affects all supported Windows versions. Although it carries a medium severity score, security experts caution that the type of leak—which can expose kernel addresses and process secrets—often arms attackers with the insight needed to craft more devastating exploits.

What exactly was fixed?

In its latest Patch Tuesday release, Microsoft rolled out a fix for CVE-2025-64670, a vulnerability in the Microsoft Graphics Component that handles DirectX and GDI+ functions. It’s an information-disclosure bug (CWE-200) caused by insufficient bounds checking in the graphics kernel driver (dxgkrnl.sys) and related user-mode libraries. When exploited, the flaw can leak kernel memory or sensitive process data.

According to the CVSS 3.1 vector, the attack requires low privileges and can be initiated over a network, though it does demand an authenticated session. That means an attacker must first gain a foothold on the target system—for example, through a compromised user account. The base score sits at 6.5 (medium), but the confidentiality impact is rated high. No public proof-of-concept has surfaced yet, but Microsoft’s advisory warns that exploitation is plausible if an attacker can interact with the graphics stack, such as by uploading specially crafted images or documents to a server that automatically processes them.

The patch arrives as a cumulative update; the specific KB number differs by Windows version. Administrators must consult Microsoft’s Security Update Guide to identify the exact package for their builds.

Who needs to worry the most?

Not every Windows user faces equal danger. The primary risk concentrates on three groups:

  • Internet-facing servers that process media files automatically. Web apps with upload forms, email gateways scanning attachments, and content-management systems that generate thumbnails all parse untrusted content without direct user interaction. Even though the vulnerability technically requires authentication, these services often run in a context that authenticates automatically, opening a pathway for remote attackers to trigger the flaw by sending a malicious file.
  • Shared desktop environments. Remote Desktop Services, Virtual Desktop Infrastructure, and terminal servers house multiple user sessions on a single OS. A low-privileged user could exploit the leak to read memory from another session or the kernel, breaking session isolation.
  • Administrator workstations and jump servers. These machines hold privileged credentials, making them prime targets for attackers who want to chain the information leak with another bug to escalate privileges.

Home users and small offices running standalone PCs with no public-facing services face much lower risk. However, because the fix flows through Windows Update, applying it is still the safest course.

Why a “medium” severity leak is a big deal

On its own, an information-disclosure bug doesn’t let an attacker run code. But in the hands of a skilled adversary, it’s a powerful tool. Modern Windows defenses rely on address space layout randomization (ASLR) to hide the location of critical system functions in memory. Leaking kernel or process addresses effectively breaks ASLR, giving attackers a map to navigate memory. They can then use that knowledge to turn a difficult, unreliable exploit into a precise, repeatable one.

Historically, DirectX memory leaks have been instrumental in attack chains. In 2023, a similar graphics component leak was paired with a use-after-free bug in win32k.sys to achieve full system compromise on patched machines. That’s why organizations treat such vulnerabilities with high urgency despite their CVSS scores.

How we got here: A recurring challenge in graphics code

Graphics subsystems are notoriously complex. They manage high-speed data transfer between applications, the kernel, and GPU drivers, often parsing rich formats (JPEG, PNG, EMF) in both user and kernel mode. The Microsoft Graphics Component touches everything from the desktop window manager to DirectX gaming APIs, so a single oversight can ripple broadly.

The security community has long targeted these interfaces. Since 2022, Microsoft’s Patch Tuesday has included multiple DirectX/GDI+ disclosures, ranging from remote code execution to denial of service. Each fix tightens the code, but the attack surface remains large. CVE-2025-64670 is the latest in that line—a reminder that even routine image parsing can crack open a system’s secrets.

What to do right now

For IT administrators

  • Identify exposed systems immediately. Use inventory tools to list all servers that handle file uploads, run document conversion or preview services, or accept remote desktop connections. Mark these as top priority.
  • Obtain the correct patch. Go to the Microsoft Security Update Guide entry for CVE-2025-64670. The page uses dynamic filtering—select your OS version and build to reveal the matching KB number. Download the update from the Microsoft Update Catalog or deploy via WSUS/SCCM/Intune. Do not rely on third-party aggregators for the KB; cross-check with the official site.
  • Test before broad deployment. Graphics kernel updates can conflict with third-party GPU drivers. Deploy the fix to a small pilot group that includes different hardware configurations (especially machines with non-Microsoft display drivers) and monitor for blue screens or performance regressions for at least 24 hours.
  • Apply compensating controls if patching must be delayed. Disable automatic thumbnail generation and preview handlers on public-facing servers. For IIS, remove the GDI+ thumbnail handler. For Exchange, configure attachment scanning to block certain image file extensions temporarily. Limit network access to RDS hosts with host-based firewalls, allowing connections only from authorized management IPs.
  • Enhance detection. Enable Windows Error Reporting (WER) and collect minidumps for dxgkrnl.sys and win32k.sys crashes. In your SIEM, create alerts for repeated graphics driver crashes in short periods, especially on servers. Look for suspicious process chains—for instance, if a low-privileged user application spawns a SYSTEM command prompt after opening an image file, it might indicate an exploit attempt.
  • Post-patch validation. After a week, review crash telemetry. A drop in graphics-related crashes is a good sign. Check for any anomalous authentication attempts or sensitive file access that could result from leaked credentials.

For home users and small offices

  • Open Windows Update, check for updates, and install all pending updates, especially any marked “Security Update.” A reboot will be required.
  • If you manage multiple PCs, ensure all are up to date. The update is the same cumulative monthly patch that includes other fixes.
  • As an extra precaution, avoid opening suspicious email attachments or clicking unknown image links until you’re patched. But the main defense is simply updating.

What to watch for next

Microsoft is unlikely to provide further technical details unless a public exploit appears. However, researchers will analyze the patch diff and may publish their findings. If a proof-of-concept emerges, the risk level for unpatched systems will spike. Organizations should keep monitoring the CVE’s page and their threat intelligence feeds.

In the longer term, Microsoft is investing in rewriting legacy graphics code in safer languages and isolating components with virtualization. Until then, expect more DirectX patches. A proactive update routine and strong server hardening remain your best defense.