Hey there! Let’s dive into the details of CVE‑2025‑50165, a critical Windows vulnerability that caught our attention. This flaw, discovered by Zscaler ThreatLabz, allows remote code execution simply by opening a specially crafted JPG file. It’s interesting to note that Microsoft classified this vulnerability as critical but deemed its exploitability less likely. Our analysis pinpointed the faulty code and reproduced the crash, leading us to believe that exploiting this scenario is more challenging than it seems.
Here are the key points of our investigation:
- We provide a detailed analysis of the CVE‑2025‑50165 vulnerability, complete with pseudocode snippets.
- We share our method to reproduce the crash using a 12-bit or 16-bit JPG image, along with an examination of the initial patch released.
- This vulnerability lies in the encoding and compressing process of a JPG image, not in its decoding.
- We explore the exploitability and attack scenario of this flaw in depth.
Delving into the Details
Zscaler ThreatLabz unveiled CVE‑2025‑50165, a high-impact remote code execution vulnerability found in Windows’ WindowsCodecs.dll. This library handles various image formats like JPG, PNG, GIF, and BMP. The vulnerability stems from an uninitialized function pointer dereference in the jpeg_finish_compress function. This specific vulnerable code path raises intriguing questions that we aimed to answer:
- What conditions lead to the dereference of the uninitialized function pointer?
- When is jpeg_finish_compress called?
- Why isn’t the function pointer initialized?
Given the prevalence of JPG images on the web, we delved into the code that triggered the crash.
Understanding the Crash Site
Upon analysis, we discovered that the crash occurs in jpeg_finish_compress+0xCC when encoding a 12-bit precision JPG image. Patch diffing and root cause analysis revealed key changes in the encoding functions. The vulnerable versions lacked proper initialization and checks, leading to the crash during compression of 12-bit or 16-bit JPG images.
Recreating the Crash
We successfully reproduced the crash by re-encoding a 12-bit JPG image, confirming the vulnerability’s presence. We also tested 16-bit precision JPG images, resulting in a crash when dereferencing the function pointer, highlighting the flaw in handling different bit depths.
Exploring the Source Code
Our investigation into the libjpeg-turbo source code revealed similar issues addressed in a previous commit. This analysis shed light on potential vulnerable code paths and the necessity of proper initialization to prevent crashes.
Assessing Exploitability
The exploitability of CVE‑2025‑50165 lies in the specific conditions required to trigger the vulnerability during (re-)encoding of JPG images. Applications using vulnerable versions of WindowsCodecs.dll and allowing image re-encoding are at risk, provided an attacker has sufficient control over the application.
Final Thoughts
While vulnerabilities like CVE‑2025‑50165 highlight the importance of staying updated on security patches, the exploitability of this flaw appears limited due to specific conditions required for its activation. Newer versions of WindowsCodecs.dll have addressed these issues, emphasizing the significance of regular software updates.
For more insights and threat intelligence services, check out ESET Threat Intelligence.
