Skip to the content
The Update Bureau
Windows 10 1607 Windows 10 1607 Security update
Patch Tuesday Zero-day

KB5040434

KB5040434: Cumulative update for Windows 10, version 1607, July 2024. Exploited MSHTML spoofing flaw addressed

In short

The update addresses 69 vulnerabilities, including an exploited MSHTML spoofing flaw and a critical Windows Imaging Component remote-code-execution flaw. It has been unavailable from Microsoft since March 31, 2026.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSB 2016, version 1607, build 14393.7159.

Build
14393.7159
Security
69 fixed · 1 critical · 1 exploited
Review notes Additional details from the official release notes (3) Read notes
  • In detail The update page says the RADIUS issue is related to MD5 collisions and refers readers to KB5040268 for more information; it does not specify a fix.
  • What changes If administrators do not configure the policy for remote paths in shortcut icons, those icons will fail to render in the Start menu, on the desktop, and on the taskbar after this update or a subsequent update.
  • Known issues A BitLocker recovery screen might appear at startup after the update; it is more likely if Device Encryption is enabled. The user might be prompted for the recovery key from their Microsoft account.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 3 changes

Republic of Turkey name

  • The official country name is now the Republic of Türkiye.1

BitLocker

For: devices using BitLocker

  • The default Secure Boot validation profile uses additional PCR measurements.2
    Adds PCR 4 to PCR 7 and 11 in the default Secure Boot validation profile.

File shortcut icons (.LNK files)

  • Icons for shortcuts to remote paths might not appear in the Start menu, on the desktop, or on the taskbar unless administrators configure a policy.3
    Configure the policy Allow the use of remote paths in file shortcut icons for remote paths used by .LNK files.

Fix 1 change

Remote Authentication Dial-In User Service (RADIUS) protocol

  • The update addresses an issue involving MD5 collisions in the RADIUS protocol.4
    For more information, Microsoft refers to KB5040268.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5044293

    After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

    On Windows Servers using the legacy Remote Procedure Call over HTTP protocol in Remote Desktop Gateway, remote desktop connections might be interrupted intermittently. KB5044293 addresses this issue.5

    Resolution Fixed in KB5044293

    Install KB5044293 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Everyone Resolved by KB5041773

    After installing the July 9, 2024, Windows security update, you might see a [BitLocker recovery](https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recov…

    Devices with Device Encryption enabled might show a BitLocker recovery screen at startup. KB5041773 addresses this issue.6

    Resolution Fixed in KB5041773

    Install KB5041773 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-07-09
Type
Cumulative update
VersionBuildChannel
1607 14393.7159 General availability

Security

69 vulnerabilities fixed
1 exploited 1 critical 66 important 2 moderate
VulnerabilitySeverityCVSS
CVE-2024-38112 Exploited
Windows MSHTML Platform Spoofing Vulnerability
 Important 7.5
CVE-2024-38060
Windows Imaging Component Remote Code Execution Vulnerability
 Critical 8.8

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 69 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. The new, official name is the Republic of Türkiye. support.microsoft.com
  2. 2. This update adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile. support.microsoft.com
  3. 3. This update changes how IT administrators should set up remote paths for file shortcut icons (.LNK files). support.microsoft.com
  4. 4. This issue is related to MD5 collisions. support.microsoft.com
  5. 5. This issue is addressed in [KB5044293] support.microsoft.com
  6. 6. This issue is addressed in [KB5041773.] support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake