Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5040427

KB5040427: Cumulative update for Windows 10, versions 21H2 and 22H2, July 2024. Exploited MSHTML spoofing flaw patched; RADIUS and BitLocker changes

In short

The update addresses 75 vulnerabilities, including an exploited MSHTML spoofing flaw and a critical Windows Imaging Component remote code execution flaw. It also changes RADIUS, BitLocker, and shortcut-icon policy behavior.

Does it affect you? Applies to: Devices running Windows 10, version 22H2, and Windows 10 Enterprise LTSC 2021 or Windows 10 IoT Enterprise LTSC 2021, version 21H2.

Builds
19044.4651 · 19045.4651
Security
75 fixed · 1 critical · 1 exploited

What changes

Improvements 3 changes

BitLocker

  • The default Secure Boot validation profile includes additional PCR measurements.1
    Adds PCR 4 to PCR 7 and 11 in the default Secure Boot validation profile. The KB refers to CVE-2024-38058 for more information.

File shortcut icons

  • IT administrators must configure a policy to allow remote paths in shortcut icons. Without it, icons on Start, the desktop, and the taskbar might fail to render after this or a later update.1
    Configure the “Allow the use of remote paths in file shortcut icons” policy.

Servicing stack

  • The component that installs Windows updates receives quality improvements to help devices reliably receive and install Microsoft updates.2
    Includes servicing stack update KB5039336, builds 19044.4585 and 19045.4585.

Fix 1 change

Remote Authentication Dial-In User Service (RADIUS) protocol

  • Addresses a RADIUS protocol issue related to MD5 collisions.3

Known issues

  1. Open Affects: Everyone

    After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

    After installing this update, changing a user account profile picture might fail with error code 0x80070520. Microsoft says the issue has very limited or no impact for this Windows version.4

    How to apply the workaround Workaround

    Contact Windows support for help.4

  2. Resolved Affects: Everyone Resolved by KB5041580

    After installing the July 9, 2024, Windows security update, you might see a [BitLocker recovery](https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recov…

    After installing the July 9, 2024 security update, a BitLocker recovery screen might appear at startup, especially if Device Encryption is enabled. KB5041580 resolves this issue.5

    Resolution Fixed in KB5041580

    Install KB5041580 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Organizations and IT administrators Resolved by KB5040525

    After you install KB5034203 (dated 01/23/2024) or later updates, some Windows devices that use the [DHCP Option 235](https://learn.microsoft.com/tr…

    Some devices using DHCP Option 235 to discover Microsoft Connected Cache nodes might be unable to use those nodes and instead download updates and apps from the public internet. This is resolved by KB5040525; Windows Home users are not likely to experience the issue.6

    Resolution Fixed in KB5040525

    Install KB5040525 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-07-09
Type
Cumulative update
VersionBuildChannel
21H2 19044.4651 General availability
22H2 19045.4651 General availability

Security

75 vulnerabilities fixed
1 exploited 1 critical 72 important 2 moderate
VulnerabilitySeverityCVSS
CVE-2024-38112 Exploited
Windows MSHTML Platform Spoofing Vulnerability
 Important 7.5
CVE-2024-38060
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 75 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. [BitLocker] This update adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. [Remote Authentication Dial-In User Service (RADIUS) protocol] This issue is related to MD5 collisions. support.microsoft.com
  4. 4. After further investigation, we concluded this issue has very limited or no impact for this Windows version.If you encounter this issue on your device, please contact Windows support for help support.microsoft.com
  5. 5. After installing the July 9, 2024, Windows security update, you might see a BitLocker recovery screen upon starting up your device. support.microsoft.com
  6. 6. This issue is addressed in KB5040525. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake