servercore:ltsc2025 contains CVEs CVE-2025-60724 and CVE-2025-49708

[slawekww]

Describe the bug
Microsoft Defender for Cloud found critical CVEs in servercore windows image:
mcr.microsoft.com/windows/servercore:ltsc2025
installed version: 10.0.26100.6584

CVEs:

• CVE-2025-60724
• CVE-2025-49708

To Reproduce
Store image in ACR and scan by MS Defender for Cloud

Expected behavior
No critical CVEs found.

Configuration:

• Windows2025

Additional context
Security compliance

[github-actions]

Thank you for creating an Issue. Please note that GitHub is not an official channel for Microsoft support requests. To create an official support request, please open a ticket here. Microsoft and the GitHub Community strive to provide a best effort in answering questions and supporting Issues on GitHub.

[slawekww]

Issue is still present.

[sureshbabu-msft]

Hi @slawekww, Thank you for reporting this. We've reviewed the two CVEs you flagged:

• CVE-2025-60724 (GDI+ heap-based buffer overflow)
• CVE-2025-49708 (GDI+ use-after-free)

Both vulnerabilities have been addressed by Microsoft in prior Patch Tuesday security updates. The latest servercore:ltsc2025
container image (OS version 10.0.26100.32522, published March 10, 2026) includes fixes for both CVEs.

To remediate, please pull the latest image and rebuild your containers:

docker pull mcr.microsoft.com/windows/servercore:ltsc2025
docker inspect mcr.microsoft.com/windows/servercore:ltsc2025 | findstr "OsVersion"

Verify the OS version is 10.0.26100.6899 or later. After redeploying, a rescan with Microsoft Defender for Cloud should confirm
the CVEs are no longer flagged.

Hope this helps — please let us know if the CVEs persist after updating.

[smiezah-msft]

Closing this issue seeing as a solution was found, feel free to open with additional details or comments.