KB5068864: Windows Server 2016 Security Update (November 2025)

An attacker who can reach a service that parses metafiles via GDI+ — the Print Spooler over RPC being the headline path — can send a crafted EMF/WMF record that overflows the heap and executes code. On the Print Spooler the process runs as SYSTEM, so the attacker gains full host control with no credentials and no user interaction. Any server-side image/document processing pipeline that uses gdiplus.dll is also a vector.

GDI+ (gdiplus.dll) is the Windows graphics library that parses image and metafile formats for virtually every Windows application. A heap-based buffer overflow occurs when GDI+ fails to validate record-size fields while parsing Enhanced Metafile (EMF) and Windows Metafile (WMF) structures — sequential variable-length records whose headers declare their own size. Crucially, system services that process graphics metadata over the network — most notably the Windows Print Spooler (spoolsv.exe) — pass attacker-supplied metafiles straight to gdiplus.dll, exposing the flaw to unauthenticated network requests.

Probably yes if any of these apply:

An attacker reaches a Windows print server's spooler RPC endpoint inside a corporate network, sends a crafted metafile, and lands SYSTEM on the print server — a host that typically holds credentials for many users and printers. From that pivot they harvest cached credentials and push a malicious driver fleet-wide. GDI+ metafile parsing has a long history as an RCE vector (MS15-035, MS16-055), and this is the same class of bug reachable unauthenticated.