Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5052000

KB5052000: Cumulative update for Windows 10, version 1809, February 2025. Storage and WinSock flaws under attack; camera detection fixed

In short

Attackers are exploiting Windows Storage and WinSock driver flaws. The update also restores USB camera detection and fixes several USB audio problems.

Does it affect you? Applies to: This update is for devices running Windows 10 Enterprise LTSC 2019, version 1809.

Build
17763.6893
Security
32 fixed · 1 critical · 2 exploited
Review notes Additional details from the official release notes (6) Read notes
  • This page The update fixes an issue where a device did not recognize that its USB camera was on after the January 2025 security update.
  • In short The update fixes an issue where a device did not recognize that its USB camera was on after the January 2025 security update.
  • In detail The update fixes an issue where a device did not recognize that its USB camera was on after the January 2025 security update.
  • What changes The update fixes an issue where a device did not recognize that its USB camera was on after the January 2025 security update.
  • In detail The OpenSSH startup issue affects some enterprise, IoT, and education devices; Microsoft is investigating whether Windows Home or Pro consumer devices are affected.
  • Known issues The OpenSSH startup issue affects some enterprise, IoT, and education devices; Microsoft is investigating whether Windows Home or Pro consumer devices are affected.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 4 changes

USB cameras

  • Some devices recognize that the USB camera is on again after the January 2025 security update.1

USB audio device drivers

For: users of certain external audio management devices

  • Some external audio devices no longer show a Code 10 error when connected.1
    Fixes the error message, “This device cannot start,” when connecting to certain external audio management devices.

Microsoft Edge IE mode

For: users of Microsoft Edge IE mode

  • Pop-up windows open in front of other windows instead of in the background.2

Digital/Analog converter (DAC)

  • Some USB audio devices no longer stop working during playback, especially with USB 1.0-based audio drivers.3
    Addresses USB audio device issues, more likely with a DAC audio driver based on USB 1.0.

Improvements 2 changes

Windows Kernel Vulnerable Driver Blocklist file

  • Adds drivers at risk of attacks that use vulnerable drivers to the blocklist.4
    Adds entries to DriverSiPolicy.p7b for drivers at risk of Bring Your Own Vulnerable Driver (BYOVD) attacks.

Servicing stack

  • The component that installs Windows updates receives quality improvements.5
    Includes servicing stack update KB5050110, build 17763.6763.

New feature 1 change

GB18030-2022

  • Adds support for the GB18030-2022 amendment.6

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Microsoft lists an installation issue for devices with certain Citrix components. Devices with Citrix Session Recording Agent version 2411 might undo the January 2025 security update when restarting to finish installation.7

    How to apply the workaround Workaround

    Update Citrix Session Recording Agent to version 2503 or later.7

  2. Open Affects: Organizations and IT administrators

    Open Secure Shell service

    Microsoft lists an OpenSSH service issue for this update. On some enterprise, IoT, and education devices, the service might fail to start after the October 2024 security update, blocking SSH connections.8

    How to apply the workaround Workaround

    KB5053596 addresses the OpenSSH startup issue.8

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-02-11
Type
Cumulative update
VersionBuildChannel
1809 17763.6893 General availability

Security

32 vulnerabilities fixed
2 exploited 1 critical 31 important
VulnerabilitySeverityCVSS
CVE-2025-21418 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-21391 Exploited
Windows Storage Elevation of Privilege Vulnerability
 Important 7.1
CVE-2025-21376
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-21377
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 32 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. [USB cameras] Fixed: Your device does not recognize the camera is on. This issue occurs after you install the January 2025 security update. support.microsoft.com
  2. 2. [Microsoft Edge IE mode] Fixed: Pop-up windows open in the background instead of in the foreground. support.microsoft.com
  3. 3. [Digital/Analog converter (DAC) (known issue)] Fixed: You might experience issues with USB audio devices. This is more likely when you use a DAC audio driver based on USB 1.0. support.microsoft.com
  4. 4. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  5. 5. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  6. 6. [GB18030-2022] This update adds support for this amendment. support.microsoft.com
  7. 7. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  8. 8. Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake