Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5060531

KB5060531: Cumulative update for Windows 10, version 1809, June 2025. Exploited shortcut-file flaw patched; GDI text rendering fixed

In short

The update closes an actively exploited remote-code-execution flaw in Internet Shortcut Files and fixes distorted GDI text. It also addresses a Windows Hello for Business certificate sign-in problem.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809, with x86 or x64 architecture.

Build
17763.7434
Security
34 fixed · 1 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What to do Windows 10 support ends on October 14, 2025. Microsoft recommends moving to Windows 11, but the page does not give a specific deadline for doing so.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 2 changes

GDI and GDI+

  • Some characters display at the correct width, and the sample paragraph is no longer broken.1

Windows Hello

For: Windows Hello for Business users

  • The update addresses a problem that can prevent sign-in with self-signed certificates using Windows Hello for Business.2
    The issue occurs with the Key Trust model.

Improvement 1 change

Servicing stack

  • The component that installs Windows updates receives quality improvements.3
    The cumulative update is combined with servicing stack update KB5058525, build 17763.7313.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5062557

    DHCP Server service

    The DHCP Server service might intermittently stop responding after this update, affecting IP renewal for clients. KB5062557, released on and after July 8, 2025, resolves the issue.4

    Resolution Fixed in KB5062557

    Install KB5062557 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-06-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5061978, KB5058392, KB5059091, KB5058922
+2 earlier KB5050008, KB5037425
Replaced by
KB5062557
VersionBuildChannel
1809 17763.7434 General availability

Security

34 vulnerabilities fixed
1 exploited 1 critical 33 important
VulnerabilitySeverityCVSS
CVE-2025-33053 Exploited
Internet Shortcut Files Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-33070
Windows Netlogon Elevation of Privilege Vulnerability
 Critical 8.1
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
 Important 8.8

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →

Updated components

666 files changed since the previous update for the same versions.

Top changed componentsFiles
Kernel11
Networking10
Search8
Secure Boot8
File Explorer and shell6
Graphics and display6
Security and sign-in6
Hyper-V and virtualization4
Remote Desktop4
Storage and file systems4
Printing2
Settings2

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. [GDI and GDI+] Fixed: Some characters were rendered wider, and the sample paragraph was broken. support.microsoft.com
  2. 2. [Windows Hello] Fixed: This update addresses an issue that prevents users from signing in with self-signed certificates when using Windows Hello for Business with the Key Trust model. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. The DHCP Server service might intermittently stop responding after installing this security update. This issue affects IP renewal for clients. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake