Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5055518

KB5055518: Cumulative update for Windows 10, versions 21H2 and 22H2, April 2025. Exploited log file driver flaw fixed; Hello sign-in tightened

In short

Attackers are exploiting a Windows Common Log File System Driver flaw to gain higher privileges. The update also changes Windows Hello face sign-in and other security protections.

Does it affect you? Applies to: This update applies to Windows 10, version 22H2, and Windows 10, version 21H2, Enterprise LTSC 2021 and IoT Enterprise LTSC 2021. It is no longer available from Microsoft release channels.

Builds
19044.5737 · 19045.5737
Security
62 fixed · 5 critical · 1 exploited

What changes

Improvements 4 changes

Windows 10, version 22H2

For: Windows 10, version 22H2 devices

  • Version 22H2 includes the improvements listed for supported Windows 10, version 21H2 editions.1
    This build includes all the improvements from the supported Windows 10, version 21H2 editions.

Daylight Saving Time (DST)

For: Windows 10, version 22H2 and 21H2 LTSC devices

  • Devices in Chile’s Aysén region get the 2025 daylight saving time change.2
    Updates the Aysén region in Chile to support the government's 2025 DST change order.

Windows Hello

For: Windows 10, version 22H2 and 21H2 LTSC devices using Windows Hello facial recognition

  • Windows Hello face sign-in requires a color camera to see a visible face.3
    For enhanced security, Windows Hello facial recognition requires color cameras to see a visible face when signing in.

Servicing stack

For: Windows 10 devices receiving this update

  • The component that installs Windows updates gets quality improvements.4
    The update combines servicing stack update KB5054682 (builds 19044.5676 and 19045.5676) with the latest cumulative update.

New feature 1 change

OS Security

For: Windows 10, version 22H2 and 21H2 LTSC devices

  • A new folder appears on the system drive for added protection. Do not delete it; no action is needed.5
    Creates %systemdrive%\inetpub even when Internet Information Services (IIS) is not enabled.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent version 2411 might fail to complete the January 2025 security update and roll back to earlier updates. Home users are not expected to be affected.6

    How to apply the workaround Workaround

    Update Citrix Session Recording Agent to version 2503 or newer; this version resolves the issue.6

  2. Open Affects: Everyone

    Noto fonts issue

    CJK text might look blurry in Chromium-based browsers at 96 DPI (100% scaling).7

    How to apply the workaround Workaround

    Increase display scaling to improve text clarity.7

  3. Open Affects: Everyone

    System Guard Runtime Monitor Broker service

    Event Viewer might show a System Guard Runtime Monitor Broker service error, Event 7023, on devices with updates released January 14, 2025, or later. It has no effect on performance, functionality, or security, and KB5055612 addresses it.8

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-04-08
Type
Cumulative update
VersionBuildChannel
21H2 19044.5737 General availability
22H2 19045.5737 General availability

Security

62 vulnerabilities fixed
1 exploited 5 critical 57 important
VulnerabilitySeverityCVSS
CVE-2025-29824 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2023-40547
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
 Critical 8.3
CVE-2025-26663
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26670
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26686
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-27491
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.1
CVE-2024-21302
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Important 6.7

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 62 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. This build includes all the improvements from the supported Windows 10, version 21H2 editions. support.microsoft.com
  2. 2. [Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. support.microsoft.com
  3. 3. After installing this update or a later Windows update, for enhanced security, Windows Hello facial recognition requires color cameras to see a visible face when signing in. support.microsoft.com
  4. 4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  5. 5. After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. support.microsoft.com
  6. 6. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. support.microsoft.com
  7. 7. Increasing the display scaling improves clarity by enhancing text rendering. support.microsoft.com
  8. 8. This issue is addressed in KB5055612. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake