Powershell GDI Plus Metafile Abuse

Tim Peck@timpeck

•updated Oct 16, 2025•2•0•78

Detects PowerShell scripts leveraging System.Drawing and System.Windows.Forms to manipulate Metafile objects. This technique can be used to trigger a denial-of-service vulnerability (related to CVE-2025-53766) in the Windows GDI component by processing a specially crafted metafile.