Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5037782

KB5037782: Cumulative update for Windows Server, version 2022, May 2024. Closes exploited MSHTML and DWM security flaws

In short

Fixes 50 vulnerabilities, including two actively exploited flaws affecting MSHTML and the Desktop Window Manager. It also addresses server, networking, and IE mode issues.

Does it affect you? Applies to: Devices running Windows Server 2022, build 20348.2461.

Build
20348.2461
Security
50 fixed · 2 exploited
Restart
Required

What changes

Fixes 12 changes

Domain controllers

  • The update addresses a known issue that might increase NTLM authentication traffic on domain controllers.1

IE mode

2 items
  • The update addresses a problem that could stop a webpage from working as expected when a modal dialog was open.2
  • The update addresses an IE mode hang that could occur when you pressed the left arrow key in an empty text box with caret browsing on.3

Group Policy editor

Verified in package
  • The update addresses failed HTML preview rendering for WPA3 settings in the Group Policy editor.4

Get-LocalGroupMember

  • The update addresses an exception from Get-LocalGroupMember when a server has been removed from a domain and local groups contain domain members.5

Networking

Verified in package
  • The update addresses a network error that occurs when credentials expire.6

LoadImage()

For: applications using LoadImage()

  • The update addresses a problem loading a top-down bitmap with a negative height; LoadImage() returned NULL.7

File sharing

For: non-domain workstations connecting to shares over IPv6

  • The update addresses an ERROR_BAD_NET_NAME error when a non-domain workstation connects to a share using an IPv6 address.8

VPN

  • The update addresses a known issue that might cause VPN connections to fail after installing the update dated April 9, 2024, or later.9

Virtual Secure Mode

  • The update addresses failures in Virtual Secure Mode scenarios, including VPN, Windows Hello, Credential Guard, and Key Guard.10

Group Policy Folder Redirection

Verified in package
  • The update addresses a problem that could prevent choosing a group account from a target domain and applying advanced folder redirection settings in certain multi-forest deployments.11
    The issue applies when the target domain has a one-way trust with the administrator's domain, including ESAE, Hardened Forests, and PAM deployments.

Windows Defender Application Control

For: devices applying WDAC Application ID policies

  • The update addresses a problem that might cause some apps to fail when WDAC Application ID policies are applied.12

Improvements 3 changes

DNS Server

For: DNS Server administrators

  • NSEC3 validation in a recursive resolver now has a default limit of 1,000 computations.13
    DNS Server administrators can change the limit using \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\MaxComputationForNsec3Validation. The allowed range is 1 to 9,600; the default is 1,000.

Windows Kernel Vulnerable Driver Blocklist

Verified in package
  • The blocklist gets its quarterly update, adding drivers at risk of Bring Your Own Vulnerable Driver (BYOVD) attacks.14
    The update changes DriverSiPolicy.p7b.

Servicing stack

  • The update includes quality improvements to the component that installs Windows updates.15
    The servicing stack update is version 20348.2461.

Known issues

  1. Open Affects: Everyone

    After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

    After installing the update, changing a user account profile picture might fail with error 0x80070520. Microsoft says this issue has very limited or no impact for this Windows version.16

    How to apply the workaround Workaround

    Contact Windows support for help if you encounter the issue.16

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-05-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5039227
VersionBuildChannel
2022 20348.2461 General availability

Security

50 vulnerabilities fixed
2 exploited 49 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-30040 Exploited
Windows MSHTML Platform Security Feature Bypass Vulnerability
 Important 8.8
CVE-2024-30051 Exploited
Windows DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 50 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
446.0 MB
windows10.0-kb5037782-x64.msu Main update · KB5037782 SHA-1: a28aa257…a9db82

Updated components

2,488 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings57
Graphics and display21
Hyper-V and virtualization19
Printing19
Security and sign-in19
Audio15
Bluetooth14
Networking14
Remote Desktop14
File Explorer and shell12
Search8
Windows Update7

Verified in package: changed files confirm Group Policy editor, Networking, Group Policy Folder Redirection, Windows Kernel Vulnerable Driver Blocklist.

Sources

Updated
Cited passages from Microsoft's official notes (16)
  1. 1. This update addresses a known issue that might affect domain controllers (DC). NTLM authentication traffic might increase. support.microsoft.com
  2. 2. This update addresses an issue that affects IE mode. A webpage stops working as expected when there is an open modal dialog. support.microsoft.com
  3. 3. This update addresses an issue in that affects IE mode. It stops responding. This occurs if you press the left arrow key when an empty text box has focus and caret browsing is on. support.microsoft.com
  4. 4. This update addresses an issue that affects Wi-Fi Protected Access 3 (WPA3) in the Group Policy editor. HTML preview rendering fails. support.microsoft.com
  5. 5. This update addresses an issue that affects a server after you remove it from a domain. The Get-LocalGroupMember cmdlet returns an exception. This occurs if the local groups contain domain members. support.microsoft.com
  6. 6. This update addresses an issue that affects a network. An error occurs when credentials expire. support.microsoft.com
  7. 7. This update addresses an issue that occurs when you use LoadImage() to load a top-down bitmap. If the bitmap has a negative height, the image does not load, and the function returns NULL. support.microsoft.com
  8. 8. This update addresses an issue that affects a workstation that is not in a domain. When you connect from it to a share and use an IPV6 address, you get the error, “ERROR_BAD_NET_NAME.” support.microsoft.com
  9. 9. This update addresses a known issue that might cause your VPN connection to fail. This occurs after you install the update dated April 9, 2024, or later. support.microsoft.com
  10. 10. This update addresses an issue that might affect Virtual Secure Mode (VSM) scenarios. They might fail. These scenarios include VPN, Windows Hello, Credential Guard, and Key Guard. support.microsoft.com
  11. 11. This issue occurs when the target domain has a one-way trust with the domain of the admin user. This issue affects all Enhanced Security Admin Environment (ESAE), Hardened Forests (HF) or Privileged Access Management (PAM) deployments. support.microsoft.com
  12. 12. This update affects Windows Defender Application Control (WDAC). The update addresses an issue that might cause some apps to fail when you apply WDAC Application ID policies. support.microsoft.com
  13. 13. This update affects next secure record 3 (NSEC3) validation in a recursive resolver. Its limit is now 1,000 computations. support.microsoft.com
  14. 14. This update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  15. 15. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  16. 16. After further investigation, we concluded this issue has very limited or no impact for this Windows version.If you encounter this issue on your device, please contact Windows support for help. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 16 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake