KB5039211: Cumulative update for Windows 10, versions 21H2 and 22H2, June 2024. Critical MSMQ flaw and exploited Mark of the Web bypass patched

Addresses 28 vulnerabilities, including a critical MSMQ remote-code-execution flaw and an exploited Mark of the Web security bypass. It also addresses two LSASS problems and changes how File Explorer tags files from untrusted locations.

Does it affect you? Applies to: This update applies to Windows 10, version 22H2, and version 21H2. The listed 21H2 editions are Enterprise, Education, IoT Enterprise, Enterprise multi-session, Enterprise LTSC 2021, and IoT Enterprise LTSC 2021. Version 21H2 Enterprise, Education, IoT Enterprise, and Enterprise multi-session reached end of service on June 11, 2024; LTSC 2021 editions remain supported.

Review notes Additional details from the official release notes (1) Read note

What changes Windows 10, version 22H2 includes the improvements from supported Windows 10, version 21H2 editions, including the File Explorer change.

The official sources are linked at the end of the page.

What changes

Improvements 3 changes

Windows 10, version 22H2

For: Devices running Windows 10, version 22H2

This build includes the improvements from the supported Windows 10, version 21H2 editions.¹

File Explorer

For: Devices running the listed Windows 10, version 21H2 editions

File Explorer adds the Mark of the Web tag to files and folders from untrusted locations. This can update the file's LastWriteTime timestamp and affect some file-copy scenarios.²
When MapUrlToZone classifies a file as “Internet,” that file also gets the Mark of the Web (MoTW) tag.

Servicing stack

For: Devices receiving this update

The component that installs Windows updates receives quality improvements to help devices reliably receive and install updates.³
Includes servicing stack update KB5037995, build 19044.4467 and 19045.4467.

Fixes 2 changes

LSASS

2 items

On Windows servers, LSASS no longer stops responding after the April 2024 security updates.⁴
Addresses an issue affecting lsass.exe after installation of the April 2024 security updates.
LSASS no longer leaks memory during a domain policy remote-protocol call.⁵
Addresses a memory leak in lsass.exe during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call.

Known issues

Open Affects: Everyone

After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

After installing this update, you might be unable to change your user account profile picture and might see error code 0x80070520. Microsoft says the issue has very limited or no impact for this Windows version.⁶

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Resolved Affects: Organizations and IT administrators Resolved by KB5040525

After you install KB5034203 (dated 01/23/2024) or later updates, some Windows devices that use the [DHCP Option 235](https://learn.microsoft.com/tr…

Some devices using DHCP Option 235 to discover Microsoft Connected Cache nodes might be unable to use those nodes and instead download updates and apps from the public internet. The issue is resolved by KB5040525; Home users are unlikely to be affected.⁷

Resolution Fixed in KB5040525

Install KB5040525 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Open Affects: Everyone

Windows devices using more than one (1) monitor might experience issues with desktop icons moving unexpectedly between monitors or other icon alignment issues when attempting to use Copilot in Window…

On devices using more than one monitor, desktop icons might move unexpectedly between monitors or become misaligned when using Copilot in Windows (in preview). A new Copilot experience for devices with KB5039299 or later is gradually rolling out and will address this issue.⁸

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Open Affects: Everyone

Copilot in Windows (in preview) is not currently supported when your taskbar is located vertically on the right or left of your screen.

Copilot in Windows (in preview) is not supported when the taskbar is vertical on the right or left of the screen. A new Copilot experience for devices with KB5039299 or later is gradually rolling out and will address this issue.⁹

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Resolved Affects: Everyone Resolved by KB5039299

Certain apps might display an "Open With" dialog box asking, "How do you want to open this file?".

Right-clicking some app icons on the taskbar or Start menu to run a task might show an “Open With” dialog instead. KB5039299 resolves this issue.¹⁰

Resolution Fixed in KB5039299

Install KB5039299 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-06-11
Type: Cumulative update

Version	Build	Channel
21H2	19044.4529	General availability
22H2	19045.4529	General availability

Security

28 vulnerabilities fixed

1 exploited 1 critical 26 important 1 moderate

Vulnerability	Severity	CVSS
CVE-2024-38213 Exploited Windows Mark of the Web Security Feature Bypass Vulnerability	Moderate	6.5
CVE-2024-30080 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability	Critical	9.8
CVE-2024-30068 Windows Kernel Elevation of Privilege Vulnerability	Important	8.8
CVE-2024-30078 Windows Wi-Fi Driver Remote Code Execution Vulnerability	Important	8.8
CVE-2024-30097 Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability	Important	8.8
CVE-2024-30077 Windows OLE Remote Code Execution Vulnerability	Important	8.0
CVE-2024-30082 Win32k Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-30085 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-30086 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-30087 Win32k Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-30089 Microsoft Streaming Service Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-30091 Win32k Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-30094 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	7.8
CVE-2024-30095 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	7.8
CVE-2024-35250 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-30093 Windows Storage Elevation of Privilege Vulnerability	Important	7.3
CVE-2024-30084 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-30088 Windows Kernel Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-30090 Microsoft Streaming Service Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-30099 Windows Kernel Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-35265 Windows Perception Service Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-30076 Windows Container Manager Service Elevation of Privilege Vulnerability	Important	6.8
CVE-2024-30063 Windows Distributed File System (DFS) Remote Code Execution Vulnerability	Important	6.7
CVE-2024-30065 Windows Themes Denial of Service Vulnerability	Important	5.5
CVE-2024-30066 Winlogon Elevation of Privilege Vulnerability	Important	5.5
CVE-2024-30067 Winlogon Elevation of Privilege Vulnerability	Important	5.5
CVE-2024-30096 Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5
CVE-2024-30069 Windows Remote Access Connection Manager Information Disclosure Vulnerability	Important	4.7

Sources

Microsoft Support: KB5039211

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (10)

1. This build includes all the improvements from the supported Windows 10, version 21H2 editions. support.microsoft.com
2. Starting in this update, File Explorer adds the Mark of the Web (MoTW) tag to files and folders that come from untrusted locations. support.microsoft.com
3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
4. This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. support.microsoft.com
5. This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. support.microsoft.com
6. After installing this update, you might be unable to change your user account profile picture. support.microsoft.com
7. some Windows devices that use the DHCP Option 235 to discover Microsoft Connected Cache (MCC) nodes in their network might be unable to use those nodes. support.microsoft.com
8. Windows devices using more than one (1) monitor might experience issues with desktop icons moving unexpectedly between monitors or other icon alignment issues when attempting to use Copilot in Windows (in preview). support.microsoft.com
9. Copilot in Windows (in preview) is not currently supported when your taskbar is located vertically on the right or left of your screen. support.microsoft.com
10. This issue is addressed in KB5039299. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Nov 8, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake