Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5039212

KB5039212: Cumulative update for Windows 11, version 23H2, June 2024. Exploited Mark of the Web bypass and critical MSMQ flaw addressed

In short

The update fixes 29 vulnerabilities, including a critical MSMQ remote-code-execution flaw and an actively exploited Mark of the Web security-feature bypass. It also addresses taskbar glitches and several system issues.

Does it affect you? Applies to: Devices running Windows 11, versions 22H2 and 23H2. The subscription-upgrade issue affects enterprise users upgrading from Windows Pro to a valid Windows Enterprise subscription.

Build
22631.3737
Security
29 fixed · 1 critical · 1 exploited
Restart
Required

What changes

Fixes 5 changes

Taskbar

  • The taskbar might briefly glitch, stop responding, or disappear and reappear; this update addresses the issue.1

LSASS

2 items
  • On Windows servers, lsass.exe might stop responding after the April 2024 security updates.2
    Listed under improvements for version 22H2; version 23H2 includes the version 22H2 improvements.
  • lsass.exe might leak memory during a Local Security Authority (Domain Policy) Remote Protocol call.4
    The protocol is identified as LSARPC. Listed under improvements for version 22H2; version 23H2 includes the version 22H2 improvements.

BitLocker

  • A device might not resume from hibernate after BitLocker is turned on.3
    Listed under improvements for version 22H2; version 23H2 includes the version 22H2 improvements.

Installation

For: Devices running Parallels Desktop on Arm-based Mac devices

  • An installation might show an error during restart and roll the device back to the previous update. This mainly affects Parallels Desktop virtual machines on Arm-based Mac devices.5
    Listed under improvements for version 22H2; version 23H2 includes the version 22H2 improvements.

Improvements 2 changes

File Explorer

  • Files and folders from untrusted locations receive a Mark of the Web tag. The changed timestamp might affect some file-copy scenarios.6
    When MapUrlToZone classifies a file as “Internet,” File Explorer adds the Mark of the Web (MoTW) tag. The LastWriteTime timestamp is updated. Listed under improvements for version 22H2; version 23H2 includes the version 22H2 improvements.

Servicing stack

  • The component that installs Windows updates receives quality improvements to help devices receive and install updates reliably.7
    Includes servicing stack update KB5037959, builds 22621.3662 and 22631.3662.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5040527

    After installing this update or later updates, you might face issues while upgrading from Windows Pro to a valid Windows Enterprise subscription.Resulting from this operation, you might observe the f…

    After this update or later updates, enterprise users might have trouble upgrading from Windows Pro to a valid Windows Enterprise subscription. The OS upgrade might fail, and the LicenseAcquisition scheduled task might show an “Access denied” error (0x80070005). KB5040527 addresses this issue.8

    Resolution Fixed in KB5040527

    Install KB5040527 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-06-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5037853, KB5037771, KB5036980, KB5036893
+6 earlier KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5040442
VersionBuildChannel
23H2 22631.3737 General availability

Security

29 vulnerabilities fixed
1 exploited 1 critical 27 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-38213 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
 Moderate 6.5
CVE-2024-30080
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-30068
Windows Kernel Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-30078
Windows Wi-Fi Driver Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-30097
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-30077
Windows OLE Remote Code Execution Vulnerability
 Important 8.0
CVE-2024-30072
Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-30082
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30085
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30086
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30087
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30089
Microsoft Streaming Service Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30091
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30094
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-30095
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-35250
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30093
Windows Storage Elevation of Privilege Vulnerability
 Important 7.3
CVE-2024-30084
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30088
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30090
Microsoft Streaming Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30099
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-35265
Windows Perception Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30076
Windows Container Manager Service Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-30063
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
 Important 6.7
CVE-2024-30065
Windows Themes Denial of Service Vulnerability
 Important 5.5
CVE-2024-30066
Winlogon Elevation of Privilege Vulnerability
 Important 5.5
CVE-2024-30067
Winlogon Elevation of Privilege Vulnerability
 Important 5.5
CVE-2024-30096
Windows Cryptographic Services Information Disclosure Vulnerability
 Important 5.5
CVE-2024-30069
Windows Remote Access Connection Manager Information Disclosure Vulnerability
 Important 4.7

Updated components

549 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display16
File Explorer and shell11
Hyper-V and virtualization6
Kernel5
Security and sign-in5
Networking4
Audio2
Secure Boot2
Remote Desktop1
Settings1

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This update addresses a known issue that affects the taskbar. It might briefly glitch or not respond. It might also disappear and reappear. support.microsoft.com
  2. 2. This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. support.microsoft.com
  3. 3. This update addresses an issue that might stop your system from resuming from hibernate. This occurs after you turn on BitLocker. support.microsoft.com
  4. 4. This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. support.microsoft.com
  5. 5. You might get an error when you restart the system. Also, the device might roll back to the previous update. This mainly occurs on Windows virtual machines (Parallels Desktop) that run on Arm based Mac devices. support.microsoft.com
  6. 6. Starting in this update, File Explorer adds the Mark of the Web (MoTW) tag to files and folders that come from untrusted locations. support.microsoft.com
  7. 7. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  8. 8. After installing this update or later updates, you might face issues while upgrading from Windows Pro to a valid Windows Enterprise subscription. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake