Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5043076

KB5043076: Cumulative update for Windows 11, version 23H2, September 2024. Exploited MSHTML spoofing flaw and Installer repair change

In short

Fixes 31 security vulnerabilities, including three that attackers are exploiting, and changes how Windows Installer repairs prompt for administrator credentials. Linux might also fail to start on some Windows-and-Linux dual-boot devices.

Does it affect you? Applies to: Devices running Windows 11, versions 22H2 or 23H2. The dual-boot issue concerns devices set up to run both Windows and Linux.

Build
22631.4169
Security
31 fixed · 1 critical · 3 exploited
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • In detail Windows Installer repairs now prompt for credentials, so automation scripts must be updated.
  • What changes Automation scripts must be updated, and application owners must add the Shield icon to show that the process requires full administrator access.
  • In short The page describes a possible Linux startup failure on Windows-and-Linux dual-boot devices, but also says Microsoft is not currently aware of issues with this update.

The official sources are linked at the end of the page.

What changes

Improvements 3 changes

Windows Installer

For: People and administrators using Windows Installer application repairs

  • When Windows Installer repairs an application, a prompt now asks for administrator credentials.1
    Automation scripts might need updating. Application owners should add the Shield icon to indicate that a process requires full administrator access. To turn off the prompt, set HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAInRepair to 1.

Dual boot of Windows and Linux

  • Linux might fail to start on a device set up to dual boot Windows and Linux.2
    The error can read: “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.”

Servicing stack

  • The package includes an update to the component that installs Windows updates.3
    Includes servicing stack update KB5043937, builds 22621.4166 and 22631.4166.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5041587, KB5041585, KB5040527, KB5040442
+12 earlier KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5044285
VersionBuildChannel
23H2 22631.4169 General availability

Security

31 vulnerabilities fixed
3 exploited 1 critical 28 important 2 not rated
VulnerabilitySeverityCVSS
CVE-2024-43461 Exploited
Windows MSHTML Platform Spoofing Vulnerability
 Important 8.8
CVE-2024-38014 Exploited
Windows Installer Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-38217 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
 Important 5.4
CVE-2024-38119
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 31 vulnerabilities →

Updated components

466 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display12
Secure Boot11
Networking6
Security and sign-in6
File Explorer and shell5
Kernel3
Audio2
Hyper-V and virtualization2
Remote Desktop1

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. When it repairs an application, the User Account Control (UAC) does not prompt for your credentials. After you install this update, the UAC will prompt for them. support.microsoft.com
  2. 2. Linux might fail to start up when you turn on dual-boot setup for Windows and Linux on your device. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake