Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5050021

KB5050021: Cumulative update for Windows 11, version 23H2, January 2025. Exploited Hyper-V flaws and critical remote-code vulnerabilities addressed

In short

Addresses 121 security vulnerabilities, including three exploited Hyper-V elevation-of-privilege flaws and five critical vulnerabilities. It also adds vulnerable drivers to the Windows kernel blocklist.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, are listed for this update. The KB page also documents changes for version 22H2.

Build
22631.4751
Security
121 fixed · 5 critical · 3 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Does it affect you? This update is for Windows 11 versions 22H2 and 23H2, with OS builds 22621.4751 and 22631.4751.

The official sources are linked at the end of the page.

What changes

Improvements 2 changes

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package

For: Windows 11, version 22H2 devices

  • The blocklist includes more drivers that could put devices at risk from attacks using vulnerable drivers.1
    Adds drivers to DriverSiPolicy.p7b that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

Servicing stack

For: Windows 11 devices

  • The component that installs Windows updates receives quality improvements.2
    The update includes servicing stack update KB5050113.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5052094

    Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections.

    The OpenSSH service might fail to start after the October 2024 security update, preventing SSH connections. KB5052094 addresses this issue.3

    Resolution Fixed in KB5052094

    Install KB5052094 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Organizations and IT administrators

    Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update.

    Devices with Citrix Session Recording Agent (SRA) version 2411 might fail to complete installation of this update and revert changes during restart. Citrix SRA version 2503 and newer resolve the issue.4

    Resolution Resolved

    Microsoft has resolved this issue in a subsequent update. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5050092

    After installing this security update, you might experience issues with USB audio devices.

    USB audio devices, especially devices using a USB 1.0 audio driver-based DAC, might stop working and prevent audio playback. KB5050092 addresses this issue.5

    Resolution Fixed in KB5050092

    Install KB5050092 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Everyone Resolved by KB5050092

    After installing this security update, you might experience issues with USB cameras.

    A USB camera might not be recognized as on after installing the update. KB5050092 addresses this issue.6

    Resolution Fixed in KB5050092

    Install KB5050092 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-01-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5048685, KB5046732, KB5046633, KB5044380
+19 earlier KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5051989
VersionBuildChannel
23H2 22631.4751 General availability

Security

121 vulnerabilities fixed
3 exploited 5 critical 116 important
VulnerabilitySeverityCVSS
CVE-2025-21333 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21334 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21335 Exploited
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21298
Windows OLE Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21307
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-21294
Microsoft Digest Authentication Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21295
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21296
BranchCache Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-21275
Windows App Package Installer Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21308
Windows Themes Spoofing Vulnerability
 Important 6.5

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 121 vulnerabilities →

Updated components

757 files changed since the previous update for the same versions.

Top changed componentsFiles
Security and sign-in16
File Explorer and shell15
Secure Boot15
Search14
Networking12
Kernel11
Storage and file systems8
Graphics and display7
Printing6
Remote Desktop3
Audio2
Emoji and input2

Verified in package: changed files confirm Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b).

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. This issue is addressed in KB5052094. support.microsoft.com
  4. 4. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  5. 5. This issue is addressed in KB5050092. support.microsoft.com
  6. 6. Your device might not recognize the camera is on. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake