KB5041578: Cumulative update for Windows 10, version 1809, August 2024. Exploited kernel flaws patched; Linux dual-boot failures remain

Addresses four exploited vulnerabilities and adds protections against vulnerable Linux bootloaders. Some Windows-and-Linux dual-boot devices might fail to start Linux.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809, build 17763.6189.

Review notes Additional details from the official release notes (1) Read note

This page Four vulnerabilities were being exploited, including a scripting-engine remote-code-execution vulnerability and several elevation-of-privilege vulnerabilities.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 6 changes

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

The driver blocklist includes more drivers at risk of Bring Your Own Vulnerable Driver attacks.¹
Adds drivers to DriverSiPolicy.p7b.

BitLocker

For: devices with device encryption enabled

A BitLocker recovery screen might appear when the device starts after the July 9, 2024 update. This is more likely when device encryption is on, and Windows might ask for the recovery key from your Microsoft account.²

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Windows applies SBAT to block vulnerable Linux EFI bootloaders. Older Linux ISO images might not boot after SBAT is applied; contact your Linux vendor for an updated image.³
The SBAT update is not intended to apply when Windows and Linux dual-booting is detected. Some customized dual-boot setups might not be detected.

Domain Name System (DNS)

For: devices using DNS servers

DNS server security is hardened. Domains with configurations that are not up to date might return a SERVFAIL error or time out.⁴
Addresses CVE-2024-37968.

Line Printer Daemon (LPD) protocol

For: devices that use LPD for printing

Printing with the deprecated LPD protocol might not work as expected or might fail after the July 9, 2024 update and later updates. UNIX clients should use IPP; Windows clients can connect to shared UNIX printers using Windows Standard Port Monitor.⁵

Servicing stack

The update includes a servicing stack update to help Windows install updates reliably.⁶
Includes Windows 10 servicing stack update KB5041577, build 17763.6174.

Fixes 2 changes

Protected Process Light (PPL) protections

Addresses a bypass in Protected Process Light protections.⁷

Lock screen

The “Use my Windows user account” checkbox is unavailable on the lock screen when connecting to Wi-Fi.⁸
Addresses CVE-2024-38143.

Removal 1 change

NetJoinLegacyAccountReuse

The NetJoinLegacyAccountReuse registry key is removed.⁹
Refer to KB5020276 for information about domain join hardening changes.

Known issues

Open Affects: Everyone

After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device.

A Windows-and-Linux dual-boot device might fail to start Linux and show a Secure Boot policy violation. The September 2024 update and later updates do not contain the settings that caused the issue; later updates include additional improvements.¹⁰

How to apply the workaround Workaround

Install the September 2024 Windows security update or a later update. Dual-boot devices need no additional steps after installing one of those updates.¹⁰
Resolved Affects: Organizations and IT administrators Resolved by KB5044277

After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

Remote Desktop connections across an organization might be interrupted on Windows Servers using the legacy RPC over HTTP protocol in Remote Desktop Gateway. The issue is resolved by KB5044277.¹¹

How to apply the workaround Workaround

Install KB5044277 or a later update to resolve the issue.¹¹
Resolved Affects: Organizations and IT administrators Resolved by KB5043050

After installing this security update, you might observe that some Windows Server 2019 devices experience system slowdowns, unresponsiveness, and high CPU usage particularly with Cryptographic Servic…

Some Windows Server 2019 devices might slow down, become unresponsive, or use high CPU, particularly with Cryptographic Services. KB5043050 addresses the issue.¹²

How to apply the workaround Workaround

Install KB5043050 or a later update to address the issue.¹²

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-08-13
Type: Cumulative update

Version	Build	Channel
1809	17763.6189	General availability

Security

39 vulnerabilities fixed

4 exploited 2 critical 36 important 1 not rated

Vulnerability	Severity	CVSS
CVE-2024-38107 Exploited Windows Power Dependency Coordinator Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38193 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38178 Exploited Scripting Engine Memory Corruption Vulnerability	Important	7.5
CVE-2024-38106 Exploited Windows Kernel Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-38140 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	9.8
CVE-2022-3775 Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences	Critical	7.1
CVE-2024-38199 Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability	Important	9.8

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 39 vulnerabilities →

Sources

Microsoft Support: KB5041578

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (12)

1. This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
2. A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. support.microsoft.com
3. This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. support.microsoft.com
4. If the configurations of your domains are not up to date, you might get the SERVFAIL error or time out. support.microsoft.com
5. Using this deprecated protocol to print might not work as you expect or fail. support.microsoft.com
6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
7. You can bypass them. support.microsoft.com
8. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi. support.microsoft.com
9. This update removes this registry key. support.microsoft.com
10. The September 2024 Windows security update (KB5043050) and later updates do not contain the settings that caused this issue. support.microsoft.com
11. This issue is addressed in KB5044277. support.microsoft.com
12. This issue is addressed in KB5043050. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 12 quoted passages · compared with Microsoft's page on Nov 14, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake