KB5051987

Cumulative update for Windows 11, version 24H2, February 2025

Attackers are exploiting flaws in Windows Storage and the WinSock Ancillary Function Driver. The update also covers critical code-execution flaws in LDAP and DHCP.

Does it affect you? Applies to: Devices running Windows 11, version 24H2, with x64 or Arm64 processors.

Review notes Additional details from the official release notes (2) Read notes

Known issues Microsoft lists the OpenSSH issue as applying to all users. It reports affected enterprise, IoT, and education customers and is investigating whether Home or Pro users are affected.
What to do Microsoft lists two vulnerabilities addressed by this update as exploited.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 2 changes

Windows operating system

Internal Windows functions get miscellaneous security improvements.¹
The release documents no additional issues for this change.

Servicing stack

The component that installs Windows updates gets quality improvements.²
Includes servicing stack update KB5052085, build 26100.3189.

Known issues

Open Affects: Organizations and IT administrators

Citrix

Devices with Citrix Session Recording Agent version 2411 might fail to finish installing the January 2025 security update and roll back.³

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Open Affects: Everyone

Roblox

Players on Arm devices might be unable to download or play Roblox from the Microsoft Store.⁴

How to apply the workaround Workaround

Players on Arm devices can download Roblox directly from Roblox.com while a resolution is pending.⁴
Open Affects: Everyone

Remote Desktop

Remote Desktop sessions on version 24H2 devices might freeze or disconnect after January 2025 and later updates. Disconnections can occur on UDP connections to Remote Desktop Services on Windows Server 2016 or earlier.⁵

How to apply the workaround Group Policy

For disconnections on an earlier update, enterprise admins can deploy the special Group Policy and restart the devices. The page says later updates address the freeze and disconnection issues.⁵
Step-by-step workaround instructions
2 steps

Show steps Hide steps
Step-by-step procedure
1. For an enterprise-managed device on an update released before March 27, 2025, deploy and configure the special Group Policy.
2. Restart the device to apply the policy.
Open Affects: Organizations and IT administrators

Open Secure Shell service

Some OpenSSH services might fail to start after the October 2024 security update, blocking SSH connections. Microsoft lists this issue for this update.⁶

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-02-11
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5050094, KB5050009, KB5048667, KB5046740

+11 earlier
KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by: KB5053598

Version	Build	Channel
24H2	26100.3194	General availability

Security

36 vulnerabilities fixed

2 exploited 2 critical 34 important

Vulnerability	Severity	CVSS
CVE-2025-21418 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-21391 Exploited Windows Storage Elevation of Privilege Vulnerability	Important	7.1
CVE-2025-21376 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability	Critical	8.1
CVE-2025-21379 DHCP Client Service Remote Code Execution Vulnerability	Critical	7.1
CVE-2025-21377 NTLM Hash Disclosure Spoofing Vulnerability	Important	6.5

The table lists the 5 exploited, publicly disclosed or critical vulnerabilities. See all 36 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 24H2

1.1 GB

windows11.0-kb5051987-x64.msu Main update · KB5051987 SHA-1: 199ed780…f71972 windows11.0-kb5043080-x64.msu Prerequisite · KB5043080 SHA-1: 95344967…9c83e8

Arm64 24H2

1.3 GB

windows11.0-kb5051987-arm64.msu Main update · KB5051987 SHA-1: f3d3fd9c…06597a windows11.0-kb5043080-arm64.msu Prerequisite · KB5043080 SHA-1: df540a05…0f090b

Updated components

445 files changed since the previous update for the same versions.

Top changed components	Files
Graphics and display	16
Networking	16
Secure Boot	8
File Explorer and shell	6
Storage and file systems	6
Security and sign-in	4
Settings	4
Kernel	3
Audio	2
Emoji and input	2
Hyper-V and virtualization	2
Windows Update	2

Sources

Microsoft Support: KB5051987

Updated Nov 7, 2026

Cited passages from Microsoft's official notes (6)

1. This update makes miscellaneous security improvements to internal OS functionality. No additional issues were documented for this release. support.microsoft.com
2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
3. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. support.microsoft.com
4. Until the resolution is available, players on Arm devices can play Roblox by downloading the title directly from www.Roblox.com. support.microsoft.com
5. After installing the January 2025 Windows preview update (KB5050094), released January 21, 2025, and later updates, on Windows 11, version 24H2 devices, you might experience Remote Desktop sessions freezing shortly after connection. support.microsoft.com
6. Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake