Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5039217

KB5039217: Cumulative update for Windows 10, version 1809, June 2024. Exploited Mark of the Web bypass addressed; LSASS issues fixed

In short

Addresses 28 vulnerabilities, including an exploited Mark of the Web security-feature bypass and a critical MSMQ remote-code-execution flaw. It also fixes two LSASS problems and updates curl.exe.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809, build 17763.5936. The affected version is supported for organizations and IT environments.

Build
17763.5936
Security
28 fixed · 1 critical · 1 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 3 changes

curl.exe

  • The version of curl.exe included with Windows is now 8.7.1.1

File Explorer

For: Devices handling files from untrusted locations

  • Files and folders from untrusted locations receive a Mark of the Web tag. Their LastWriteTime timestamp might change, which can affect some file-copy scenarios.2
    When MapUrlToZone classifies a file as “Internet,” the file gets the Mark of the Web tag and its LastWriteTime timestamp is updated.

Servicing stack

  • The component that installs Windows updates receives quality improvements.3
    Includes servicing stack update KB5039335, build 17763.5920.

Fixes 2 changes

lsass.exe

2 items
  • On Windows servers, LSASS no longer stops responding after the April 2024 security updates.4
  • LSASS no longer leaks memory during a Local Security Authority (Domain Policy) Remote Protocol call.5

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5040430

    After installing KB5039217, released June 11, 2024, you might observe a chang…

    Some Windows application menus and dialog buttons might appear in English when English is not the Windows display language. Font sizes for tab and button names might also change. KB5040430 addresses this issue.6

    Resolution Fixed in KB5040430

    Install KB5040430 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-06-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5037425
VersionBuildChannel
1809 17763.5936 General availability

Security

28 vulnerabilities fixed
1 exploited 1 critical 26 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-38213 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
 Moderate 6.5
CVE-2024-30080
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-30068
Windows Kernel Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-30078
Windows Wi-Fi Driver Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-30097
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-30077
Windows OLE Remote Code Execution Vulnerability
 Important 8.0
CVE-2024-30082
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30085
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30086
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30087
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30089
Microsoft Streaming Service Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30091
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30094
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-30095
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-35250
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30093
Windows Storage Elevation of Privilege Vulnerability
 Important 7.3
CVE-2024-30084
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30088
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30090
Microsoft Streaming Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30099
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-35265
Windows Perception Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30076
Windows Container Manager Service Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-30063
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
 Important 6.7
CVE-2024-30065
Windows Themes Denial of Service Vulnerability
 Important 5.5
CVE-2024-30066
Winlogon Elevation of Privilege Vulnerability
 Important 5.5
CVE-2024-30067
Winlogon Elevation of Privilege Vulnerability
 Important 5.5
CVE-2024-30096
Windows Cryptographic Services Information Disclosure Vulnerability
 Important 5.5
CVE-2024-30069
Windows Remote Access Connection Manager Information Disclosure Vulnerability
 Important 4.7

Downloads (Microsoft Update Catalog)

Arm64 1809
666.5 MB
windows10.0-kb5039217-arm64.msu Main update · KB5039217 SHA-1: 664c2f37…da20de

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This update affects the version of curl.exe that is in Windows. The version number is now 8.7.1. support.microsoft.com
  2. 2. Starting in this update, File Explorer adds the Mark of the Web (MoTW) tag to files and folders that come from untrusted locations. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. support.microsoft.com
  5. 5. This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. support.microsoft.com
  6. 6. After installing KB5039217, released June 11, 2024, you might observe a change in language for context menus and dialog buttons in Windows applications. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake