Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5051989

KB5051989: Cumulative update for Windows 11, version 23H2, February 2025. Exploited Storage and Winsock flaws patched; Hyper-V backups fixed

In short

Attackers are exploiting flaws in Windows Storage and the Winsock driver. The update also fixes delays that could disrupt Hyper-V backups.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, including x64 and Arm64 devices. The listed Hyper-V backup fix is in the Windows 11, version 22H2 section of the update page.

Build
22631.4890
Security
32 fixed · 1 critical · 2 exploited
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • Does it affect you? This update covers Windows 11 versions 22H2 and 23H2, with builds 22621.4890 and 22631.4890, respectively.
  • Known issues The OpenSSH service issue is addressed in KB5052094.
  • Known issues The USB printer issue is addressed in KB5053657.

The official sources are linked at the end of the page.

What changes

Fix 1 change

Hyper-V

For: devices using Hyper-V backups

  • Hyper-V backup delays that might stop backups from running smoothly are fixed.1

Improvement 1 change

Servicing stack

  • The servicing stack, which installs Windows updates, gets quality improvements.2
    The servicing stack update is KB5053488, build 22621.4890 and 22631.4890.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent version 2411 might fail to finish installing the January 2025 Windows security update. They might undo the changes and return to the previous update.3

    How to apply the workaround Workaround

    For devices with Session Recording Agent version 2411, install version 2503 or newer.3

  2. Open Affects: Organizations and IT administrators

    USB Printer Issue

    Some enterprise USB dual-mode printers might print random text and network commands after this update. This can happen when the printer starts or reconnects.4

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Everyone

    Open Secure Shell service

    Microsoft lists an OpenSSH service issue reported after the October 2024 security update. On some enterprise, IoT, and education devices, the service might fail to start and block SSH connections; consumer impact is under investigation.5

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-02-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5050092, KB5050021, KB5048685, KB5046732
+21 earlier KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5053602
VersionBuildChannel
23H2 22631.4890 General availability

Security

32 vulnerabilities fixed
2 exploited 1 critical 31 important
VulnerabilitySeverityCVSS
CVE-2025-21418 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21391 Exploited
Windows Storage Elevation of Privilege Vulnerability
 Important 7.1
CVE-2025-21376
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21377
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 32 vulnerabilities →

Updated components

474 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display5
Secure Boot4
Security and sign-in4
Storage and file systems4
Kernel3
Audio2
Hyper-V and virtualization2
Networking2
File Explorer and shell1
Remote Desktop1

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. [Hyper-V] Fixed: In backup scenarios, there is a delay. This might stop backups from running smoothly. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  4. 4. After installing this update, you might observe issues with USB connected dual-mode printers that support both USB Print and IPP Over USB protocols. support.microsoft.com
  5. 5. Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake