KB5034770: Cumulative update for Windows Server, version 2022, February 2024. Exploited kernel and SmartScreen flaws patched

For: Administrators of virtual machines using RDMA

• RDMA performance counters return networking data for virtual machines correctly.¹
  Addresses incorrect RDMA performance counter data on VMs.

• fontdrvhost.exe no longer stops responding when you use CFF2 fonts.²
  Addresses a hang in fontdrvhost.exe when using Compact Font Format version 2 (CFF2) fonts.

• A memory leak in ctfmon.exe is addressed.³
  Addresses a memory leak in ctfmon.exe.
• A memory leak in TextInputHost.exe is addressed.⁴
  Addresses a memory leak in TextInputHost.exe.

For: Devices hosting protected content

• Out-of-process content such as WebView2 can continue to be hosted under protected, top-level windows.⁵
  Prevents cross-process windows from being created for protected content, allowing out-of-process hosting under protected, top-level windows.

For: Devices with touchscreens and multiple monitors

• Touchscreens work properly when you use more than one monitor.⁶
  Addresses touchscreen behavior with multiple monitors.

• WDAC allow policies no longer block some binaries from running.⁷
  Addresses an issue where Windows Defender Application Control (WDAC) “allow” policies might block some binaries.

• LSASS is less likely to stop working when accessing the Active Directory database.⁸
  Addresses an LSASS failure that can occur when accessing the Active Directory database.

For: Administrators publishing Delta CRLs

• You can select the Delta CRL option in the Certificate Authority snap-in to publish Delta CRLs.⁹
  Addresses the inability to select the “Delta CRL” option in the Certificate Authority snap-in.

For: Devices using Windows LAPS and this policy

• You can sign in to a Windows LAPS-managed local account when the Require Smart Card for Interactive Logon policy is set.¹⁰
  Addresses sign-in failures for a Windows LAPS-managed local account when the “Require Smart Card for Interactive Logon” policy is set.

For: Devices using SMB multichannel

• SMB connections no longer disconnect in the specified encryption and multichannel configuration.¹¹
  Addresses disconnects when the client and server encryption cipher lists differ from the defaults and have no ciphers in common, SMB encryption is not in use, and a multichannel configuration such as RDMA is in place.

• SMB over QUIC no longer stops responding when port 445 is blocked.¹²
  Addresses an SMB over QUIC hang when port 445 is blocked.

• Addresses a problem that could keep Chromium-based browsers from opening correctly; they might show a white screen or stop responding.¹³
  The issue might occur on devices with browser-specific Image File Execution Options (IFEO), or when a Chromium-based browser has an entry in the Windows registry.

For: Administrators of UEFI Secure Boot systems

• A renewed signing certificate is available for UEFI Secure Boot systems; you can opt in to this change.¹⁴
  Adds a renewed signing certificate to the Secure Boot DB variable. See KB5036210 for details.

• Downloads of device metadata over HTTPS are more secure.¹⁵
  Improves the security of device metadata downloads from Windows Metadata and Internet Services (WMIS) over HTTPS.

• The vulnerable-driver blocklist includes additional drivers that could be used in BYOVD attacks.¹⁶
  Includes quarterly changes to DriverSiPolicy.p7b, adding drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

For: Administrators using Active Directory Users & Computers

• The snap-in uses a stronger certificate mapping by default.¹⁷
  Changes the default mapping to X509IssuerSerialNumber instead of the weak x509IssuerSubject mapping.

• The component that installs Windows updates receives quality improvements.¹⁸
  Includes the Windows Server 2022 servicing stack update, version 20348.2305.