Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5051979

KB5051979: Cumulative update for Windows Server, version 2022, February 2025. Exploited Storage and Winsock driver flaws patched

In short

Attackers are exploiting elevation-of-privilege flaws in Windows Storage and the Winsock ancillary function driver. The update also fixes server issues, including USB audio playback problems.

Does it affect you? Applies to: Devices running Windows Server 2022, including x64 systems.

Build
20348.3207
Security
34 fixed · 1 critical · 2 exploited
Restart
Required
Review notes Additional details from the official release notes (4) Read notes
  • What changes The CPU index issue affects servers with two or more NUMA nodes.
  • What changes The CPU index issue affects servers with two or more NUMA nodes.
  • In detail The update fixes directory enumeration failures involving symbolic links with long target names.
  • What changes The update fixes directory enumeration failures involving symbolic links with long target names.

The official sources are linked at the end of the page.

What changes

Fixes 8 changes

Task Manager

  • Task Manager might show the wrong CPU number after you limit which CPUs a process can use. This affects servers with two or more memory groups.1
    Fixes incorrect CPU index numbers when setting process affinity on servers with two or more non-uniform memory access (NUMA) nodes.

Memory leak

For: devices using predictive input

  • Predictive typing suggestions no longer cause memory leaks.2
    Fixes memory leaks that occur when predictive input ideas show.

Device Health Attestation

For: devices upgraded from Windows Server 2016

  • Upgrading from Windows Server 2016 no longer leaves out a required item that can stop a service.3
    Fixes a missing crucial item after an upgrade from Windows Server 2016 that causes service failure.

Directory enumeration

  • Searching a folder no longer fails when it contains links to folders with long names.4
    Fixes directory enumeration failures when a directory contains symbolic links with long target names.

Bind Filter Driver

  • The system is less likely to stop responding when it follows file or folder links.5
    Fixes a system hang when the Bind Filter Driver accesses symbolic links.

Digital/Analog converter (DAC) (known issue)

Verified in package
  • Fixes problems that can stop USB audio devices from playing sound, especially with some audio drivers.6
    Addresses USB audio device issues, more likely with DAC audio drivers based on USB 1.0.

USB cameras

  • USB cameras work again when the device fails to detect that the camera is on.7
    Fixes camera detection problems that occur after installing the January 2025 security update.

USB audio device drivers

Verified in package

For: devices using certain external audio management devices

  • Some external audio devices no longer show a “This device cannot start” error when connected.8
    Fixes Code 10 errors when connecting to certain external audio management devices.

Improvements 2 changes

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package
  • Adds more at-risk drivers to the blocklist that helps protect against attacks using vulnerable drivers.9
    Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to DriverSiPolicy.p7b.

Servicing stack

  • Includes an update to the component that installs Windows updates.10
    Includes servicing stack update KB5050117, build 20348.3081.

New feature 1 change

GB18030-2022

  • Adds support for the GB18030-2022 amendment.11

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent version 2411 might fail to install the January 2025 security update and undo the changes after restarting. Home users are not expected to be affected.12

    How to apply the workaround Workaround

    Install Citrix Session Recording Agent version 2503, released April 28, 2025, or a newer version.12

  2. Open Affects: Everyone

    System Guard Runtime Monitor Broker service

    Event Viewer might show a System Guard Runtime Monitor Broker service error on devices with updates from January 14, 2025, or later. The error is otherwise silent and should not affect performance, features, or device security.13

    How to apply the workaround Workaround

    KB5055526 addresses this issue; do not manually start, configure, uninstall, or remove the service or its components.13

  3. Open Affects: Organizations and IT administrators

    Open Secure Shell service

    On some devices, the OpenSSH service might fail to start, preventing SSH connections. The issue affects some enterprise, IoT, and education customers; Microsoft is still checking whether Home or Pro users are affected.14

    How to apply the workaround Workaround

    KB5053603 addresses this issue.14

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-02-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5052819, KB5049983, KB5048654, KB5046616
+13 earlier KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5053603
VersionBuildChannel
2022 20348.3207 General availability

Security

34 vulnerabilities fixed
2 exploited 1 critical 33 important
VulnerabilitySeverityCVSS
CVE-2025-21418 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21391 Exploited
Windows Storage Elevation of Privilege Vulnerability
 Important 7.1
CVE-2025-21376
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21377
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
381.0 MB
windows10.0-kb5051979-x64.msu Main update · KB5051979 SHA-1: 8b40fef9…e3ae39

Updated components

608 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop12
Graphics and display10
Networking9
Search6
Storage and file systems6
Settings5
File Explorer and shell4
Hyper-V and virtualization4
Secure Boot4
Printing3
Security and sign-in3
Windows Update3

Verified in package: changed files confirm Digital/Analog converter (DAC) (known issue), USB audio device drivers, Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b).

Sources

Updated
Cited passages from Microsoft's official notes (14)
  1. 1. [Task Manager] Fixed: The CPU index number might be wrong when you set process affinity. This occurs on servers that have two or more non-uniform memory access (NUMA) nodes. support.microsoft.com
  2. 2. [Memory leak] Fixed: Leaks occur when predictive input ideas show. support.microsoft.com
  3. 3. [Device Health Attestation] Fixed: When you upgrade from Windows Server 2016, a crucial item is not there. Because of this, service fails. support.microsoft.com
  4. 4. [Directory enumeration] Fixed: This might fail if a directory has symbolic links that have long target names. support.microsoft.com
  5. 5. [Bind Filter Driver] Fixed: Your system might stop responding when it accesses symbolic links. support.microsoft.com
  6. 6. [Digital/Analog converter (DAC) (known issue)] Fixed: You might experience issues with USB audio devices. This is more likely when you use a DAC audio driver based on USB 1.0. support.microsoft.com
  7. 7. [USB cameras] Fixed: Your device does not recognize the camera is on. This issue occurs after you install the January 2025 security update. support.microsoft.com
  8. 8. [USB audio device drivers] Fixed: The code 10 error message, “This device cannot start” appears. This occurs when you connect to certain external audio management devices. support.microsoft.com
  9. 9. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  10. 10. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  11. 11. [GB18030-2022] This update adds support for this amendment. support.microsoft.com
  12. 12. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  13. 13. This issue is addressed in KB5055526. support.microsoft.com
  14. 14. This issue is addressed in KB5053603. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 14 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake