Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8 .NET Framework 3.5 / 4.8 Update
Patch Tuesday

KB5037930

KB5037930: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows Server 2022, May 2024. WPF app crashes and concurrent type-query failures addressed

In short

Concurrent type queries can crash the .NET runtime, and WPF apps can crash when reading window text. A later update, KB5043743, resolves a separate SQL CLR runtime exception.

Does it affect you? Applies to: Windows Server 2022 devices with .NET Framework 3.5 or 4.8 installed.

File version
2.0.50727.9176 · 4.8.4729.0
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What changes The response-time regression affects 32-bit platforms; the fix is not limited to a particular kind of reader.

The official sources are linked at the end of the page.

What changes

Fixes 5 changes

CLR

  • Concurrent checks of the same managed type can crash the runtime; this update addresses the problem.1
    Addresses crashes when several threads concurrently query the ITypeInfo implementation of the same managed type.

.NET Libraries

2 items
  • Some 32-bit platforms can have much slower response times; this update addresses the slowdown.2
    Addresses a significant response-time regression on 32-bit platforms.
  • The update addresses an issue with using MIST-validated FIPS algorithms.3
    Addresses an issue with using MIST-validated implementations of FIPS algorithms.

.NET Fundamentals

  • An issue with wildcard formatting introduced in IIS 10 is addressed.4
    Addresses an issue with wildcard format changes introduced in IIS 10.

WPF

Verified in package
  • Some apps can crash when they read window text; this update addresses the problem.5
    Addresses crashes in apps calling GetWindowText and GetWindowTextLength.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5043743

    Microsoft received reports about .NET Framework May cumulative update causing customers to observe runtime exceptions in certain SQL CLR hosted scenarios.

    Certain SQL CLR scenarios can produce runtime exceptions involving SHA-2 constructors. KB5043743 resolves this issue.6

    How to apply the workaround Workaround

    Mark the assembly that uses the affected SHA-2 types as UNSAFE so their constructors can run in the SQL CLR host.6

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-05-14
Classification
Updates
Type
Cumulative update
Restart
Required
Replaces
KB5034613
Replaced by
KB5039889
VersionFile versionChannel
3.5 2.0.50727.9176 General availability
4.8 4.8.4729.0 General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

x64 Windows Server 2022
66.9 MB
windows10.0-kb5037930-x64-ndp48.msu Main update · KB5037930 SHA-1: e382f083…d9657d

Updated components

74 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF22
.NET runtime (CLR)12
WCF12

Verified in package: changed files confirm WPF.

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. Addresses an issue where crashes can occur if several threads all concurrently query the ITypeInfo implementation of the same managed type support.microsoft.com
  2. 2. Addresses an issue where 32-bit platform show a significant response time regression. support.microsoft.com
  3. 3. Addresses an issue to use MIST validated implementations of FIPS algorithms. support.microsoft.com
  4. 4. Addresses an issue with wildcard format changes introduced in IIS 10. support.microsoft.com
  5. 5. Addresses an issue where apps crash when calling GetWindowText and GetWindowTextLength methods. support.microsoft.com
  6. 6. Microsoft has resolved this issue with update KB5043743. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake