Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday

KB5049983

KB5049983: Cumulative update for Windows Server, version 2022, January 2025. Remote Desktop and OLE flaws patched; vulnerable-driver list grows

In short

Patches 122 vulnerabilities, including eight critical flaws, and adds at-risk drivers to the blocklist to help guard against BYOVD attacks.

Does it affect you? Applies to: Devices running Windows Server 2022.

Build
20348.3091
Security
122 fixed · 8 critical
Restart
Required

What changes

Improvements 2 changes

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package
  • The vulnerable-driver blocklist includes more drivers that could be used in BYOVD attacks.1
    Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to DriverSiPolicy.p7b.

Servicing stack

  • The component that installs Windows updates receives quality improvements.2
    Includes servicing stack update KB5050117, build 20348.3081.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5053603

    Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

    The OpenSSH service could fail to start after the October 2024 security update, preventing SSH connections. KB5053603 later addressed the issue.3

    Resolution Fixed in KB5053603

    Install KB5053603 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Organizations and IT administrators

    Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update.

    Devices with Citrix Session Recording Agent version 2411 might fail to complete installation of the January 2025 security update and revert to their previous updates. Citrix Session Recording Agent version 2503 and newer resolves the issue.4

    Resolution Resolved

    Microsoft has resolved this issue in a subsequent update. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5055526

    The Windows Event Viewer might display an error related to SgrmBroker.exe, on devices that have installed Windows updates released January 14, 2025, or later.

    Event Viewer might show a System Guard Runtime Monitor Broker error, Event 7023, after Windows updates released January 14, 2025, or later. It has no expected effect on performance, functionality, or device security; KB5055526 addresses it.5

    Resolution Fixed in KB5055526

    Install KB5055526 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Everyone Resolved by KB5051979

    After installing this security update, you might experience issues with USB audio devices.

    USB audio devices might stop working after this update, preventing audio playback; USB 1.0 audio driver-based DACs are more likely to be affected. KB5051979 addresses the issue.6

    Resolution Fixed in KB5051979

    Install KB5051979 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-01-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5048654, KB5046616, KB5047767, KB5044281
+11 earlier KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5052819
VersionBuildChannel
2022 20348.3091 General availability

Security

122 vulnerabilities fixed
8 critical 114 important
VulnerabilitySeverityCVSS
CVE-2025-21298
Windows OLE Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21307
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-49120
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21294
Microsoft Digest Authentication Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21295
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21297
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21309
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21296
BranchCache Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-21275
Windows App Package Installer Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21308
Windows Themes Spoofing Vulnerability
 Important 6.5

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 122 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
380.6 MB
windows10.0-kb5049983-x64.msu Main update · KB5049983 SHA-1: 50422578…b4a10d

Updated components

438 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking12
Secure Boot10
Security and sign-in9
Hyper-V and virtualization8
File Explorer and shell7
Kernel7
Search7
Graphics and display5
Printing4
Storage and file systems4
Emoji and input3
Remote Desktop2

Verified in package: changed files confirm Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b).

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. This issue is addressed in KB5053603. support.microsoft.com
  4. 4. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  5. 5. This issue is addressed in KB5055526. support.microsoft.com
  6. 6. This issue is addressed in KB5051979. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake