Critical Windows Graphics Vulnerability Lets Hackers Seize Control with a Single Image

**Critical RCE in Windows Graphics Component (CVE-2025-50165)** — A CVSS 9.8 remote code execution flaw in windowscodecs.dll enables attackers to achieve arbitrary code execution by delivering specially crafted JPEGs (including embedded in Office documents) that trigger an uninitialized pointer dereference and heap-spray-based ROP chains; Microsoft released patches on August 12, 2025 for affected builds and vendors recommend immediate patching, disabling image previews for untrusted files, and sandboxing.