Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally.

The remote Windows host is missing security update 5063875. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
    (CVE-2025-53766)

  - Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent     network. (CVE-2025-49751)

  - Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft     Graphics Component allows an authorized attacker to elevate privileges locally. (CVE-2025-49743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5063880 or hot patch 5063812. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
    (CVE-2025-53766)

  - Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent     network. (CVE-2025-49751)

  - Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft     Graphics Component allows an authorized attacker to elevate privileges locally. (CVE-2025-49743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5063899. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
    (CVE-2025-53766)

  - Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent     network. (CVE-2025-49751)

  - Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft     Graphics Component allows an authorized attacker to elevate privileges locally. (CVE-2025-49743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5063878. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
    (CVE-2025-53766)

  - Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent     network. (CVE-2025-49751)

  - Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft     Graphics Component allows an authorized attacker to elevate privileges locally. (CVE-2025-49743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
249138	KB5063875: Windows 11 version 22H2 / Windows 11 version 23H2 Security Update (August 2025)	Nessus	Windows : Microsoft Bulletins	critical
249126	KB5063880: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (August 2025)	Nessus	Windows : Microsoft Bulletins	critical
249122	KB5063899: Windows 11 version 22H2 / Windows Server version 23H2 Security Update (August 2025)	Nessus	Windows : Microsoft Bulletins	critical
249117	KB5063878: Windows 11 Version 24H2 / Windows Server 2025 Security Update (August 2025)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2025-50176

high

Tenable Plugins

critical

critical

critical

critical