Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5049981

KB5049981: Cumulative update for Windows 10, versions 21H2 and 22H2, January 2025. Exploited Hyper-V flaws fixed among 121 vulnerabilities

In short

Addresses 121 vulnerabilities, including five critical flaws and three exploited Hyper-V vulnerabilities. It also adds drivers to the vulnerable driver blocklist for LTSC editions.

Does it affect you? Applies to: The update applies to Windows 10 version 22H2 and Windows 10 version 21H2 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 editions.

Builds
19044.5371 · 19045.5371
Security
121 fixed · 5 critical · 3 exploited

What changes

Improvements 3 changes

Windows 10, version 22H2

For: Devices running Windows 10 version 22H2

  • Version 22H2 includes all the improvements from supported Windows 10 version 21H2 editions.1

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

For: Windows 10 version 21H2 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 devices

  • The vulnerable driver blocklist includes more drivers that could be used in BYOVD attacks.2
    Adds drivers to DriverSiPolicy.p7b that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

Servicing stack

For: Windows 10 devices

  • The component that installs Windows updates receives quality improvements.3
    Servicing stack update KB5050388, build 19044.5363 and 19045.5363.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5052077

    Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

    After the October 2024 security update, the OpenSSH service might fail to start and prevent SSH connections. KB5052077 addresses the issue.4

    Resolution Fixed in KB5052077

    Install KB5052077 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Organizations and IT administrators

    Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update.

    Devices with Citrix Session Recording Agent version 2411 might fail to complete the January 2025 security update and revert to their previous updates. Citrix Session Recording Agent version 2503 or newer resolves the issue.5

    Resolution Resolved

    Microsoft has resolved this issue in a subsequent update. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5055612

    The Windows Event Viewer might display an error related to SgrmBroker.exe, on devices that have installed Windows updates released January 14, 2025, or later.

    Event Viewer might show a System event 7023 error related to SgrmBroker.exe after installing updates released January 14, 2025, or later. It does not affect device performance, functionality, or security, and KB5055612 addresses it.6

    Resolution Fixed in KB5055612

    Install KB5055612 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Everyone Resolved by KB5050081

    After installing this security update, you might experience issues with USB audio devices.

    USB audio devices might stop working after this security update, preventing audio playback. The issue is more likely with USB 1.0 audio driver-based DACs and is addressed by KB5050081.7

    Resolution Fixed in KB5050081

    Install KB5050081 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  5. Resolved Affects: Everyone Resolved by KB5050081

    After installing this security update, you might experience issues with USB cameras.

    After this security update, a device might not recognize that its USB camera is on. KB5050081 addresses the issue.8

    Resolution Fixed in KB5050081

    Install KB5050081 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-01-14
Type
Cumulative update
VersionBuildChannel
21H2 19044.5371 General availability
22H2 19045.5371 General availability

Security

121 vulnerabilities fixed
3 exploited 5 critical 116 important
VulnerabilitySeverityCVSS
CVE-2025-21333 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21334 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21335 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21298
Windows OLE Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21307
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21294
Microsoft Digest Authentication Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21295
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21296
BranchCache Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-21275
Windows App Package Installer Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21308
Windows Themes Spoofing Vulnerability
 Important 6.5

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 121 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This build includes all the improvements from the supported Windows 10, version 21H2 editions. support.microsoft.com
  2. 2. This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. This issue is addressed in KB5052077. support.microsoft.com
  5. 5. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  6. 6. This issue is addressed in KB5055612. support.microsoft.com
  7. 7. This issue is addressed in KB5050081. support.microsoft.com
  8. 8. This issue is addressed in KB5050081. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake