Analyzing CVE-2021-1665 – Remote Code Execution Vulnerability in Windows GDI+

This report documents McAfee's discovery and root-cause analysis of CVE-2021-1665 — a GDI+ Remote Code Execution vulnerability triggered by malformed EmfPlusDrawString records. It explains how WinAFL fuzzing produced a PoC that caused a heap/object corruption loop (due to an unchecked BuiltLine::GetUntrimmedCharacterCount return value), shows how patch diffing and debugging identified the fix (an added check and destructor), and recommends applying Microsoft updates to remediate the issue.