It's 2017... And Windows PCs can be pwned via DNS, webpages, Office docs, fonts – and some TPM keys are fscked too • The Register

https://www.theregister.co.uk/2017/10/10/october_2017_microsoft_windows_patch_tuesday/