Microsoft has patched multiple vulnerabilities in Windows affecting various components. The most critical vulnerability is CVE-2025-60724 in the GDI+ Graphics Component with CVSS 9.8, allowing arbitrary code execution. Attack vectors include Denial-of-Service, arbitrary code execution with admin rights, access to sensitive data, and privilege escalation. The GDI+ vulnerability can be exploited by tricking users to download malicious files or through public web services without user interaction. Total of 42 CVEs were patched across Windows components including DirectX, Remote Desktop, Bluetooth, Hyper-V, and kernel components.