Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5041585

KB5041585: Cumulative update for Windows 11, version 23H2, August 2024. Scripting Engine flaw exploited; Linux dual-boot may fail

In short

The update fixes 43 security vulnerabilities, including an exploited Scripting Engine flaw, and changes that can stop some Windows/Linux dual-boot PCs from starting Linux.

Does it affect you? Applies to: The update applies to Windows 11, versions 22H2 and 23H2. The documented Linux boot issue affects some devices configured to dual-boot Windows and Linux.

Build
22631.4037
Security
43 fixed · 3 critical · 4 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What changes A BitLocker recovery screen can appear after the July 9, 2024 update; it is more likely when device encryption is on.

The official sources are linked at the end of the page.

What changes

Improvements 3 changes

Lock screen

  • The “Use my Windows user account” checkbox is no longer available when connecting to Wi-Fi from the lock screen.1
    Addresses CVE-2024-38143.

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package

For: Windows systems; Linux dual-boot devices are excluded when detected

  • The update blocks vulnerable Linux bootloaders on Windows systems. Older Linux ISO images might not boot afterward.2
    SBAT is not applied when Windows detects a Windows/Linux dual-boot setup. Some older Linux ISO images might not boot after SBAT is applied.

Servicing stack

  • Includes improvements to the component that installs Windows updates.3
    Includes servicing stack update KB5041584, builds 22621.4027 and 22631.4027.

Fix 1 change

BitLocker (known issue)

For: devices with device encryption

  • Addresses the BitLocker recovery screen issue that began after the July 9, 2024 update.4
    The recovery screen can appear when the device starts, more often when device encryption is on.

Removal 1 change

NetJoinLegacyAccountReuse

  • The NetJoinLegacyAccountReuse registry key is removed.5
    See KB5020276 for information about Netjoin domain-join hardening changes.

Known issues

  1. Open Affects: Everyone

    After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device.

    Some devices set up to dual-boot Windows and Linux might fail to start Linux and show “Verifying shim SBAT data failed: Security Policy Violation.” The September 2024 update and later do not contain the settings that caused this issue; dual-boot devices need no additional steps after installing one of those updates.6

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-08-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5040527, KB5040442, KB5039302, KB5039212
+10 earlier KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5043076
VersionBuildChannel
23H2 22631.4037 General availability

Security

43 vulnerabilities fixed
4 exploited 3 critical 40 important
VulnerabilitySeverityCVSS
CVE-2024-38107 Exploited
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-38193 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-38178 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2024-38106 Exploited
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-38063
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-38140
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2022-3775
Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences
 Critical 7.1
CVE-2024-38199
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
 Important 9.8

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 43 vulnerabilities →

Updated components

1,243 files changed since the previous update for the same versions.

Top changed componentsFiles
Secure Boot18
Graphics and display17
Remote Desktop16
Security and sign-in14
File Explorer and shell13
Search12
Kernel9
Emoji and input6
Networking6
Printing4
Storage and file systems4
Audio2

Verified in package: changed files confirm Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI).

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi. support.microsoft.com
  2. 2. This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. support.microsoft.com
  5. 5. This update removes this registry key. support.microsoft.com
  6. 6. After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake