Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5053602

KB5053602: Cumulative update for Windows 11, version 23H2, March 2025. Exploited MMC, NTFS and FAT flaws patched

In short

Attackers are exploiting flaws in MMC, NTFS, and FAT, alongside critical remote-code risks. Some enterprise USB printers may print random text; KB5053657 addresses that issue.

Does it affect you? Applies to: Devices running Windows 11, versions 22H2 and 23H2.

Build
22631.5039
Security
33 fixed · 3 critical · 5 exploited
Restart
Required

What changes

Improvements 3 changes

Windows 11, version 23H2

For: Windows 11, version 23H2 devices

  • Version 23H2 includes all the improvements in version 22H2.1

Internal OS functionality

For: Windows 11, version 22H2 devices

  • Internal operating system functions get security improvements.2
    The page lists this change under Windows 11, version 22H2.

Servicing stack

For: Windows 11 devices

  • The component that installs Windows updates gets quality improvements.3
    The update includes servicing stack update KB5052107.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent 2411 might fail to complete installation of the January 2025 Windows security update. Home users are not expected to be affected.4

    How to apply the workaround Workaround

    Update Citrix Session Recording Agent to version 2503 or newer; that version resolves the issue.4

  2. Open Affects: Organizations and IT administrators

    USB Printer Issue

    Some enterprise users might find that USB-connected dual-mode printers print random text and data after installing this update.5

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Everyone

    Microsoft Copilot

    Microsoft Copilot might be removed and unpinned from the taskbar on some devices. Microsoft says the issue is fixed and affected devices are being restored.6

    How to apply the workaround Workaround

    Reinstall Microsoft Copilot from the Microsoft Store and pin it to the taskbar.6

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-03-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5052094, KB5051989, KB5050092, KB5050021
+23 earlier KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5055528
VersionBuildChannel
23H2 22631.5039 General availability

Security

33 vulnerabilities fixed
5 exploited 3 critical 30 important
VulnerabilitySeverityCVSS
CVE-2025-24985 Exploited
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24993 Exploited
Windows NTFS Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-26633 Exploited
Microsoft Management Console Security Feature Bypass Vulnerability
 Important 7.0
CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 4.6
CVE-2025-26645
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-24084
Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability
 Critical 8.4
CVE-2025-24035
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 33 vulnerabilities →

Updated components

528 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display20
Search12
Kernel9
Storage and file systems6
Remote Desktop5
Secure Boot5
Security and sign-in4
File Explorer and shell3
Audio2
Hyper-V and virtualization2

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This build includes all the improvements in Windows 11, version 22H2. support.microsoft.com
  2. 2. This update makes miscellaneous security improvements to internal OS functionality. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. support.microsoft.com
  5. 5. After installing this update, you might observe issues with USB connected dual-mode printers that support both USB Print and IPP Over USB protocols. support.microsoft.com
  6. 6. This issue has been fixed, and the affected devices are being returned to their original state. You can also reinstall the app from the Microsoft Store and pin it to the taskbar. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake