Skip to the content
The Update Bureau
Windows 11 24H2 Windows 11 24H2 Security update
Patch Tuesday Zero-day

KB5046617

KB5046617: Cumulative update for Windows 11, version 24H2, November 2024. Exploited Task Scheduler and NTLM flaws patched

In short

Fixes 30 security vulnerabilities, including two exploited flaws and a critical VMSwitch flaw. It also fixes Task Manager group counts, Dev Drive access, and some IPv4 connection failures.

Does it affect you? Applies to: Devices running Windows 11, version 24H2, on x64 or Arm64.

Build
26100.2314
Security
30 fixed · 1 critical · 2 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 3 changes

Task Manager

  • The Processes tab shows the correct group count when you turn on “Group by type.”1
    Fixes the group count showing as wrong or zero (0).

Windows Subsystem for Linux (WSL)

For: Devices using a Dev Drive

  • You can access your Dev Drive again.2

Internet connection

  • Some devices can connect to the internet again when duplicate DHCP options had stopped IPv4 connections on certain networks.3
    Addresses an issue triggered by duplicate DHCP options in a DHCP server response.

Improvement 1 change

Servicing stack

  • The component that installs Windows updates receives quality improvements.4
    Includes servicing stack update KB5047621, build 26100.2303.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5052093

    Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

    After the October 2024 security update, some customers reported that the OpenSSH service failed to start and SSH connections were prevented. The issue affected a limited number of enterprise, IoT, and education devices; Microsoft was investigating whether Home or Pro users were affected. KB5052093 addresses the issue.5

    Resolution Fixed in KB5052093

    Install KB5052093 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Open Affects: Everyone

    We’re aware of an issue where players on Arm devices are unable to download and play Roblox via the Microsoft Store on Windows.

    Players on Arm devices cannot download or play Roblox through the Microsoft Store on Windows.6

    How to apply the workaround Workaround

    Download Roblox directly from Roblox.com.6

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-11-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5044284, KB5043178, KB5043080, KB5041865
+5 earlier KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5050009
VersionBuildChannel
24H2 26100.2314 General availability

Security

30 vulnerabilities fixed
2 exploited 1 critical 29 important
VulnerabilitySeverityCVSS
CVE-2024-49039 Exploited
Windows Task Scheduler Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-43451 Exploited
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5
CVE-2024-43625
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
 Critical 8.1
CVE-2024-43620
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-43621
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-43622
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-43624
Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-43627
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-43628
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-43635
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-43623
Windows NT OS Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-43626
Windows Telephony Service Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-43629
Windows DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-43630
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-43636
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-43641
Windows Registry Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-43644
Windows Client-Side Caching Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-49046
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-43452
Windows Registry Elevation of Privilege Vulnerability
 Important 7.5
CVE-2024-43642
Windows SMB Denial of Service Vulnerability
 Important 7.5
CVE-2024-43449
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-43634
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-43637
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-43638
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-43643
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-43631
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Important 6.7
CVE-2024-43646
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Important 6.7
CVE-2024-43633
Windows Hyper-V Denial of Service Vulnerability
 Important 6.5
CVE-2024-38203
Windows Package Library Manager Information Disclosure Vulnerability
 Important 6.2
CVE-2024-38264
Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability
 Important 5.9

Updated components

836 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display19
Hyper-V and virtualization13
Remote Desktop12
File Explorer and shell10
Secure Boot6
Security and sign-in6
Networking5
Bluetooth4
Kernel3
Storage and file systems3
Printing2
Windows Update2

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. [Task Manager (known issue)] Fixed: The count for the number of groups is wrong or always zero (0) on the Processes tab. This occurs when you turn on “Group by type.” support.microsoft.com
  2. 2. [Windows Subsystem for Linux (WSL)] Fixed: You cannot access your Dev Drive. support.microsoft.com
  3. 3. [Internet connection] Fixed: A small number of devices cannot connect to the internet. This occurs when a DHCP server response has duplicate DHCP options. This stops IPv4 connections on certain networks. support.microsoft.com
  4. 4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  5. 5. This issue is addressed in KB5052093. support.microsoft.com
  6. 6. Players on Arm devices can play Roblox by downloading the title directly from www.Roblox.com. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake