Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday

KB5050008

KB5050008

Cumulative update for Windows 10, version 1809, January 2025

In short

The update fixes 112 vulnerabilities, including five critical ones and the publicly disclosed Windows Themes flaw CVE-2025-21308. It also expands the blocklist of drivers at risk of BYOVD attacks.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809, on x86 or x64.

Build
17763.6775
Security
112 fixed · 5 critical
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 2 changes

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package
  • The blocklist includes more drivers that could be used in BYOVD attacks.1
    Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to DriverSiPolicy.p7b.

Servicing stack

  • The component that installs Windows updates receives quality improvements.2
    Includes the Windows 10 servicing stack update KB5050110, build 17763.6763.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5053596

    Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

    On some enterprise, IoT, and education devices, the OpenSSH service might fail to start after the October 2024 security update, preventing SSH connections. KB5053596 addresses this issue.3

    Resolution Fixed in KB5053596

    Install KB5053596 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Organizations and IT administrators

    Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update.

    Devices with Citrix Session Recording Agent version 2411 might fail to complete installation of the January 2025 security update and revert the changes. The issue is resolved in Citrix Session Recording Agent version 2503 and newer; home users are not expected to be affected.4

    Resolution Resolved

    Microsoft has resolved this issue in a subsequent update. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5052000

    After installing this security update, you might experience issues with USB audio devices.

    Some USB audio devices might stop working after this update, especially devices using a USB 1.0 audio driver based DAC. Device Manager might show Code 10. KB5052000 addresses this issue.5

    Resolution Fixed in KB5052000

    Install KB5052000 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-01-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5037425
Replaced by
KB5058922
VersionBuildChannel
1809 17763.6775 General availability

Security

112 vulnerabilities fixed
5 critical 107 important
VulnerabilitySeverityCVSS
CVE-2025-21298
Windows OLE Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21307
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21294
Microsoft Digest Authentication Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21295
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21296
BranchCache Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-21308
Windows Themes Spoofing Vulnerability
 Important 6.5

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 112 vulnerabilities →

Updated components

3,204 files changed since the previous update for the same versions.

Top changed componentsFiles
Networking32
Remote Desktop26
Security and sign-in25
Secure Boot21
Hyper-V and virtualization17
Graphics and display16
Printing16
File Explorer and shell14
Storage and file systems13
Kernel11
Search10
Audio7

Verified in package: changed files confirm Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b).

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. This issue is addressed in KB5053596. support.microsoft.com
  4. 4. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  5. 5. This issue is addressed in KB5052000. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake