VulnSocial

CVE-2025-53766PoC(microsoft / 365_copilot)

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for microsoft 365_copilot systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

microsoft CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-122

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • 365_copilot
  • office
  • windows_10_1507
  • windows_10_1607

Threat summary

  • Public PoC and exploit tooling are both present
  • 1 mentions across 1 observed day

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
microsoft
Products
365_copilotofficewindows_10_1507windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_22h2windows_11_23h2windows_11_24h2

2 versions affected across 17 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-03-30: 1PoC Mentioned / Linked · 2026-03-30: 1Exploit Tool / Code · 2026-03-30: 1Technical Details · 2026-03-30: 103-30
Signal classification1 categories
PoC
1100.0%
Full discourse1 post
  • Sheba Bakut@ShebaBakut
    PoC

    Top finding: CVE-2025-53766 — GDI+ RCE → Risk score: 25/25 → No credentials required → PoC exploit is publicly available → Full domain compromise from the internet If this were a real org, any attacker with a browser could own the DC.

    Post summary

    The post highlights the CVE-2025-53766 GDI+ RCE with a publicly available PoC exploit and a 25/25 risk score, but lacks patch information or evidence of active exploitation.

    00001208
    23 followersView on X
CPE platform detail23 entries

23 of 23 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoft365_copilot-android-
Appmicrosoftoffice-universal-
OSmicrosoftwindows_10_1507--x64
OSmicrosoftwindows_10_1507--x86
OSmicrosoftwindows_10_1607--x64
OSmicrosoftwindows_10_1607--x86
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2---
OSmicrosoftwindows_10_22h2---
OSmicrosoftwindows_11_22h2---
OSmicrosoftwindows_11_23h2---
OSmicrosoftwindows_11_24h2---
OSmicrosoftwindows_server_2008--x64
OSmicrosoftwindows_server_2008--x86
OSmicrosoftwindows_server_2008r2-x64
OSmicrosoftwindows_server_2012---
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2022_23h2---
OSmicrosoftwindows_server_2025---

Explore more

Back to dashboardmicrosoft CVEs365_copilot vulnerabilities