Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5053596

KB5053596: Cumulative update for Windows 10, version 1809, March 2025. Exploited NTFS and FAT flaws patched; Citrix issue remains

In short

Fixes 29 vulnerabilities, including flaws in NTFS and the Fast FAT driver that attackers are exploiting. It also fixes an OpenSSH startup problem; Citrix SRA 2411 can still block installation of the January 2025 update.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809.

Build
17763.7009
Security
29 fixed · 2 critical · 5 exploited

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 3 changes

Daylight saving time (DST)

  • Daylight saving time changes for Paraguay are updated.1

Temporary files

  • System processes can store temporary files in a secure directory, reducing the risk of unauthorized access.2
    System processes can use C:\Windows\SystemTemp through the GetTempPath2 API or .NET's GetTempPath API.

Servicing stack

  • The component that installs Windows updates receives quality improvements.3
    The cumulative update includes servicing stack update KB5054007, build 17763.7000.

Fix 1 change

Open Secure Shell (OpenSSH)

  • The OpenSSH service starts again, allowing SSH connections.4
    Fixes the service startup failure that previously required running sshd.exe manually; the issue had no detailed logging.

New feature 1 change

GB18030-2022

For: devices and applications that use GB18030-2022

  • Support is added for the GB18030-2022 amendment.5

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Some devices with Citrix Session Recording Agent (SRA) version 2411 might fail to complete installation of the January 2025 Windows security update. The installation can roll back. Citrix SRA version 2503, released April 28, 2025, or newer resolves the issue; home users are not expected to be affected.6

    How to apply the workaround Workaround

    Upgrade Citrix SRA to version 2503 or newer.6

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-03-11
Type
Cumulative update
VersionBuildChannel
1809 17763.7009 General availability

Security

29 vulnerabilities fixed
5 exploited 2 critical 27 important
VulnerabilitySeverityCVSS
CVE-2025-24985 Exploited
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24993 Exploited
Windows NTFS Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-26633 Exploited
Microsoft Management Console Security Feature Bypass Vulnerability
 Important 7.0
CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 4.6
CVE-2025-26645
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-24035
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24051
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-24056
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-21180
Windows exFAT File System Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24044
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24046
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24048
Windows Hyper-V Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24050
Windows Hyper-V Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24059
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24061
Windows Mark of the Web Security Feature Bypass Vulnerability
 Important 7.8
CVE-2025-24066
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24067
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24072
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24995
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24987
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.6
CVE-2025-24988
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.6
CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5
CVE-2025-24071
Microsoft Windows File Explorer Spoofing Vulnerability
 Important 6.5
CVE-2025-24996
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5
CVE-2025-24992
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-21247
MapUrlToZone Security Feature Bypass Vulnerability
 Important 4.3
CVE-2025-24055
Windows USB Video Class System Driver Information Disclosure Vulnerability
 Important 4.3
CVE-2024-9157
Synaptics: CVE-2024-9157 Synaptics Service Binaries DLL Loading Vulnerability
 Important —

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. [Daylight saving time (DST)] Updated: DST changes for Paraguay. support.microsoft.com
  2. 2. [Temporary files] This update enables system processes to store temporary files in a secure directory "C:\Windows\SystemTemp" via either calling GetTempPath2 API or using .NET's GetTempPath API, thereby reducing the risk of unauthorized access. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. [Open Secure Shell (OpenSSH) (known issue)] Fixed: The service fails to start, which stops SSH connections. support.microsoft.com
  5. 5. [GB18030-2022] This update adds support for this amendment. support.microsoft.com
  6. 6. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake