CVE‑2025‑50165: Critical Windows Imaging Component RCE via Crafted JPEG

What happened

On November 20 2025, Zscaler ThreatLabz disclosed CVE‑2025‑50165, a flaw in WindowsCodecs.dll that allows an attacker to execute arbitrary code by opening a specially crafted JPEG file. The bug resides in the jpeg_finish_compress function, which is invoked during JPEG compression and re‑encoding.

Impact

• Remote code execution on any Windows system that processes the malicious image.
• Critical severity rating by Microsoft, but the attack vector requires the victim to open or process the file, limiting mass exploitation.
• Affected components: Windows 10, Windows 11, Windows Server 2019/2022 via the Windows Imaging Component.

Exploitability

The vulnerability stems from dereferencing an uninitialized function pointer during JPEG compression. While the code path is reachable, it demands that the image be processed by an application that calls the compression routine, which is uncommon for typical user‑facing image viewers. Consequently, the likelihood of widespread exploitation remains low.

Mitigation

• Apply the latest cumulative update that patches WindowsCodecs.dll (KB‑XXXXX).
• On servers or endpoints that do not require image compression, disable the Windows Imaging Component via group policy or registry tweaks.
• Deploy endpoint protection that flags anomalous JPEG processing or unexpected calls to jpeg_finish_compress.
• Monitor for unusual file‑open events involving JPEG files in privileged processes.

Recommendations for defenders

1. Verify that all Windows systems have the latest security updates installed. 2. Restrict or monitor applications that perform JPEG compression on the network. 3. Use application whitelisting to prevent unauthorized image‑processing binaries from executing. 4. Keep an eye on security advisories for any new variants or related weaknesses in the Windows Imaging Component.