CVE-2025-64670 Overview
CVE-2025-64670 is an information disclosure vulnerability in the Microsoft Graphics Component affecting multiple supported versions of Windows and Windows Server. An authorized attacker can exploit the flaw over a network to disclose sensitive information from the targeted system. The weakness is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Microsoft documented the issue in the Microsoft CVE-2025-64670 Update Guide and released fixes through the standard security update channel.
Critical Impact
An authenticated remote attacker can read sensitive data processed by the Microsoft Graphics Component on current Windows 10, Windows 11, and Windows Server platforms.
Affected Products
- Microsoft Windows 10 21H2 and 22H2
- Microsoft Windows 11 23H2, 24H2, and 25H2
- Microsoft Windows Server 2022, Server 2022 23H2, and Server 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-64670 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64670
Vulnerability Analysis
The Microsoft Graphics Component processes image and rendering data for Windows user-mode and kernel-mode subsystems. CVE-2025-64670 is an information disclosure flaw in this component that lets an authenticated attacker read data they should not access. The vulnerability is reachable over a network, which means the attacker does not require local console access to the target host. Successful exploitation does not alter data or impact service availability, but the disclosed content may include memory contents or other sensitive artifacts handled by the graphics subsystem. Microsoft classifies the issue under [CWE-200] exposure of sensitive information to an unauthorized actor.
Root Cause
Microsoft has not published source-level details. Based on the CWE-200 mapping and the component scope, the root cause involves the Microsoft Graphics Component returning data to a caller without properly restricting what the requester is allowed to see. This class of issue typically stems from uninitialized buffers, improper boundary enforcement, or missing access checks when the component returns rendering or image-processing output.
Attack Vector
The attack vector is network-based and requires low-privilege authentication on the target. No user interaction is needed. An attacker with valid credentials can submit crafted requests that cause the Microsoft Graphics Component to return sensitive content. Confidentiality is impacted; integrity and availability are not. Refer to the Microsoft CVE-2025-64670 Update Guide for Microsoft's assessment of exploitability.
No public proof-of-concept code or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-64670
Indicators of Compromise
- No vendor-published indicators of compromise are available for CVE-2025-64670 at this time.
- Monitor for unexpected authenticated access patterns that invoke graphics or print-related RPC and SMB endpoints from non-interactive accounts.
Detection Strategies
- Audit Windows Security event logs for anomalous authenticated sessions from service accounts or hosts that do not typically interact with graphics-related services.
- Correlate network telemetry showing SMB, RPC, or print subsystem traffic against user baselines to flag unusual callers to the Microsoft Graphics Component.
- Validate that affected Windows and Windows Server hosts report the relevant December 2025 cumulative update as installed.
Monitoring Recommendations
- Track authentication events (Event IDs 4624, 4625, 4672) for low-privilege accounts initiating lateral network sessions.
- Alert on repeated or malformed graphics-related RPC calls targeting workstations and servers.
- Baseline normal access to graphics and print services, then alert on deviations by source host, user, or volume.
How to Mitigate CVE-2025-64670
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2025-64670 Update Guide to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching for multi-user systems, Remote Desktop Session Hosts, and servers where many authenticated users have network access.
- Review and reduce the number of standing low-privilege accounts that can reach internal Windows hosts over the network.
Patch Information
Microsoft has released security updates for all affected products through its standard monthly servicing channel. Administrators should install the cumulative update that references CVE-2025-64670 on Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, and 25H2, and Windows Server 2022, 2022 23H2, and 2025. Confirm installation using Get-HotFix or Windows Update for Business reports.
Workarounds
- Microsoft has not documented a supported workaround. Patching is the required remediation.
- Restrict network access to Windows hosts using host-based firewall rules and network segmentation to limit which authenticated principals can reach the Microsoft Graphics Component.
- Enforce least privilege and remove unused interactive and service accounts to reduce the pool of attackers that could satisfy the authentication precondition.
# Verify the relevant cumulative update is installed on a Windows host
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
