Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5048685

KB5048685: Cumulative update for Windows 11, version 23H2, December 2024. Exploited log-file driver flaw patched among 10 critical fixes

In short

The update patches an actively exploited Windows Common Log File System Driver flaw and addresses 46 vulnerabilities, including 10 rated critical.

Does it affect you? Applies to: Devices running Windows 11, versions 22H2 and 23H2.

Build
22631.4602
Security
46 fixed · 10 critical · 1 exploited
Restart
Required

What changes

Improvements 2 changes

Windows operating system

  • Windows receives security improvements to internal operating-system functions.1
    The 23H2 build includes the improvements in 22H2, including miscellaneous security improvements to internal OS functionality.

Servicing stack

  • The component that installs Windows updates receives reliability improvements to help devices receive and install updates.2
    Includes servicing stack update KB5046729.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5052094

    Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

    Following the October 2024 security update, the OpenSSH service might fail to start and prevent SSH connections. The issue affects a limited number of enterprise, IoT, and education devices; Microsoft was investigating whether Windows Home or Pro devices were affected. KB5052094 resolves the issue.3

    Resolution Fixed in KB5052094

    Install KB5052094 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-12-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5046732, KB5046633, KB5044380, KB5044285
+18 earlier KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5050021
VersionBuildChannel
23H2 22631.4602 General availability

Security

46 vulnerabilities fixed
1 exploited 10 critical 36 important
VulnerabilitySeverityCVSS
CVE-2024-49138 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-49112
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-49117
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2024-49105
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2024-49118
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49122
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49123
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49124
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49126
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49127
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49132
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-43583
Winlogon Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 12 exploited, publicly disclosed or critical vulnerabilities. See all 46 vulnerabilities →

Updated components

554 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display14
Hyper-V and virtualization10
Remote Desktop8
File Explorer and shell7
Kernel6
Printing6
Emoji and input5
Networking4
Settings3
Secure Boot2
Storage and file systems2
Bluetooth1

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This update makes miscellaneous security improvements to internal OS functionality. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. This issue is addressed in KB5052094. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake