Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5053606

KB5053606: Cumulative update for Windows 10, versions 21H2 and 22H2, March 2025. Exploited NTFS, Fast FAT, and MMC flaws patched

In short

Attackers are exploiting flaws in NTFS, Fast FAT, and Microsoft Management Console; the update also covers critical Remote Desktop code-execution flaws. Windows 10 support has since ended.

Does it affect you? Applies to: The update applies to Windows 10, version 22H2, and Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021, version 21H2.

Builds
19044.5608 · 19045.5608
Security
30 fixed · 2 critical · 5 exploited

What changes

Improvements 3 changes

Windows 10, version 22H2

For: Windows 10, version 22H2 devices

  • Version 22H2 includes all improvements from supported Windows 10, version 21H2 editions.1

Windows 10, version 21H2

For: Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 devices

  • The update makes security improvements to internal Windows functions.2

Servicing stack

For: Windows 10 devices

  • The part of Windows that installs updates gets quality improvements.3
    The servicing stack update is KB5052916, build 19044.5547.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Organizations with Citrix Session Recording Agent 2411 might see the January 2025 security update fail and roll back. Home users are not expected to be affected.4

    How to apply the workaround Workaround

    Install Citrix Session Recording Agent version 2503 or newer; Citrix released version 2503 on April 28, 2025.4

  2. Open Affects: Everyone

    System Guard Runtime Monitor Broker service

    Event Viewer might log a System Guard Runtime Monitor Broker error after updates released January 14, 2025, or later. The error has no expected effect on performance, features, or security; KB5055612 addresses it.5

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Organizations and IT administrators

    USB Printer Issue

    Some enterprise users with USB dual-mode printers might see random text and network commands printed, especially after the printer powers on or reconnects.6

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  4. Open Affects: Everyone

    Microsoft Copilot

    On some devices, Microsoft Copilot might be removed and unpinned from the taskbar. Microsoft says the issue is fixed and affected devices are being restored.7

    How to apply the workaround Workaround

    Reinstall the app from the Microsoft Store and pin it to the taskbar.7

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-03-11
Type
Cumulative update
VersionBuildChannel
21H2 19044.5608 General availability
22H2 19045.5608 General availability

Security

30 vulnerabilities fixed
5 exploited 2 critical 28 important
VulnerabilitySeverityCVSS
CVE-2025-24985 Exploited
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24993 Exploited
Windows NTFS Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-26633 Exploited
Microsoft Management Console Security Feature Bypass Vulnerability
 Important 7.0
CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 4.6
CVE-2025-26645
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-24035
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24051
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-24056
Windows Telephony Service Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-21180
Windows exFAT File System Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24044
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24046
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24048
Windows Hyper-V Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24050
Windows Hyper-V Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24059
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24061
Windows Mark of the Web Security Feature Bypass Vulnerability
 Important 7.8
CVE-2025-24066
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24067
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24072
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24995
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-24987
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.6
CVE-2025-24988
Windows USB Video Class System Driver Elevation of Privilege Vulnerability
 Important 6.6
CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5
CVE-2025-24071
Microsoft Windows File Explorer Spoofing Vulnerability
 Important 6.5
CVE-2025-24996
NTLM Hash Disclosure Spoofing Vulnerability
 Important 6.5
CVE-2025-24992
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-24997
DirectX Graphics Kernel File Denial of Service Vulnerability
 Important 4.4
CVE-2025-21247
MapUrlToZone Security Feature Bypass Vulnerability
 Important 4.3
CVE-2025-24055
Windows USB Video Class System Driver Information Disclosure Vulnerability
 Important 4.3
CVE-2024-9157
Synaptics: CVE-2024-9157 Synaptics Service Binaries DLL Loading Vulnerability
 Important —

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This build includes all the improvements from the supported Windows 10, version 21H2 editions. support.microsoft.com
  2. 2. This update makes miscellaneous security improvements to internal OS functionality. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. support.microsoft.com
  5. 5. This issue is addressed in KB5055612. support.microsoft.com
  6. 6. You might observe that the printer unexpectedly prints random text and data, including network commands and unusual characters. support.microsoft.com
  7. 7. This issue has been fixed, and the affected devices are being returned to their original state. You can also reinstall the app from the Microsoft Store and pin it to the taskbar. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake