Skip to the content
The Update Bureau
Windows 11 24H2 Windows 11 24H2 Security update
Patch Tuesday Zero-day

KB5050009

KB5050009: Cumulative update for Windows 11, version 24H2, January 2025. Three exploited Hyper-V kernel integration flaws patched

In short

Three actively exploited Hyper-V flaws make this security update important to install. It also expands the vulnerable-driver blocklist and documents an open Roblox issue on Arm devices.

Does it affect you? Applies to: Devices running Windows 11, version 24H2.

Build
26100.2894
Security
121 fixed · 6 critical · 3 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 2 changes

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package
  • Windows adds more at-risk drivers to its blocklist to help protect against Bring Your Own Vulnerable Driver attacks.1
    The update adds drivers to DriverSiPolicy.p7b.

Servicing stack

  • The component that installs Windows updates receives quality improvements to help devices receive and install updates reliably.2
    The update includes servicing stack update KB5050387, build 26100.2890.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5052093

    Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

    On some devices, the OpenSSH service might fail to start after the October 2024 security update, preventing SSH connections. The issue is resolved by KB5052093.3

    Resolution Fixed in KB5052093

    Install KB5052093 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Organizations and IT administrators

    Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update.

    Devices with Citrix Session Recording Agent (SRA) version 2411 might fail to complete installation of the January 2025 security update and roll back the changes. Citrix resolved the issue in SRA version 2503 and later.4

    Resolution Resolved

    Microsoft has resolved this issue in a subsequent update. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5050094

    After installing this security update, you might experience issues with USB audio devices.

    USB audio devices might stop working after this update, preventing audio playback. The issue is more likely with a USB 1.0 audio driver based DAC and is addressed by KB5050094.5

    Resolution Fixed in KB5050094

    Install KB5050094 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Everyone Resolved by KB5050094

    After installing this security update, you might experience issues with USB cameras.

    After this update, a USB camera might not be recognized as being on. The issue is addressed by KB5050094.6

    Resolution Fixed in KB5050094

    Install KB5050094 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  5. Open Affects: Everyone

    We’re aware of an issue where players on Arm devices are unable to download and play Roblox via the Microsoft Store on Windows.

    Players on Arm devices might be unable to download and play Roblox through the Microsoft Store. Downloading Roblox directly from Roblox.com is a workaround.7

    How to apply the workaround Workaround

    Download Roblox directly from Roblox.com instead of using the Microsoft Store.7

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-01-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5048667, KB5046740, KB5046617, KB5044384
+9 earlier KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5051987
VersionBuildChannel
24H2 26100.2894 General availability

Security

121 vulnerabilities fixed
3 exploited 6 critical 115 important
VulnerabilitySeverityCVSS
CVE-2025-21333 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21334 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21335 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21298
Windows OLE Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21307
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21311
Windows NTLM V1 Elevation of Privilege Vulnerability
 Critical 9.8
CVE-2025-21294
Microsoft Digest Authentication Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21295
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21296
BranchCache Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-21275
Windows App Package Installer Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21308
Windows Themes Spoofing Vulnerability
 Important 6.5

The table lists the 11 exploited, publicly disclosed or critical vulnerabilities. See all 121 vulnerabilities →

Updated components

1,660 files changed since the previous update for the same versions.

Top changed componentsFiles
Secure Boot17
File Explorer and shell16
Security and sign-in15
Networking14
Search14
Graphics and display13
Kernel11
Storage and file systems10
Printing9
Remote Desktop9
Emoji and input6
Hyper-V and virtualization5

Verified in package: changed files confirm Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b).

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. This issue is addressed in KB5052093. support.microsoft.com
  4. 4. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. support.microsoft.com
  5. 5. This issue is addressed in KB5050094. support.microsoft.com
  6. 6. This issue is addressed in KB5050094. support.microsoft.com
  7. 7. Players on Arm devices can play Roblox by downloading the title directly from www.Roblox.com. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake