Skip to the content
The Update Bureau
Windows 11 24H2 Windows 11 24H2 Security update
Patch Tuesday Zero-day

KB5055523

KB5055523: Cumulative update for Windows 11, version 24H2, April 2025. Exploited CLFS flaw patched; sign-in and display issues noted

In short

Patches an actively exploited Windows log-file driver flaw and addresses other security issues. Some Citrix, Windows Hello, blue-screen, and CJK text issues remain listed.

Does it affect you? Applies to: Devices running Windows 11, version 24H2, on x64 or Arm64 systems.

Build
26100.3775
Security
68 fixed · 5 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What changes Microsoft updated the x64 MSU file listed under Catalog in Method 2 on June 1, 2026.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 4 changes

Daylight Saving Time (DST)

For: Devices using the Aysen region time zone

  • The update supports Chile’s government-ordered daylight saving time change for 2025.1
    The change applies to the Aysen region in Chile.

Windows Hello

  • Windows Hello facial recognition requires a color camera to see a visible face when you sign in.2
    This security change relates to CVE-2025-26644.

AI components

  • Three AI components receive updated versions.3
    Image Search, Content Extraction, and Semantic Analysis are updated to version 1.7.820.0.

Servicing stack

  • The component that installs Windows updates receives quality improvements.4
    The update includes servicing stack update KB5058538, build 26100.3764.

Fix 1 change

Authentication

For: Devices using Kerberos with Credential Guard

  • A machine password rotation issue that could cause sign-in problems is addressed. The related Machine Accounts in Credential Guard feature is disabled until a permanent fix is available.5
    The issue affects machine password rotation in the Identity Update Manager certificate/PKNIT path, particularly with Kerberos and Credential Guard enabled.

New feature 1 change

OS Security

  • A new inetpub folder is created to improve protection. Do not delete it, whether or not IIS is enabled.6
    The folder is %systemdrive%\inetpub. The change relates to CVE-2025-21204.

Known issues

  1. Open Affects: Everyone

    Noto fonts issue

    CJK text might look blurry in Chromium-based browsers at 96 DPI (100% scaling).7

    How to apply the workaround Workaround

    Increasing display scaling improves text clarity.7

  2. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent (SRA) version 2411 might fail to install the January 2025 security update and roll back. Home users are not expected to be affected.8

    How to apply the workaround Workaround

    Citrix says SRA version 2503 and newer resolves the issue.8

  3. Open Affects: Everyone

    Windows Hello

    On devices where System Guard Secure Launch or DRTM is enabled after this update, Windows Hello facial recognition or PIN might stop working after a Push button reset or Reset this PC using Keep my Files and Local install.9

    How to apply the workaround Workaround

    KB5055627 is listed as addressing this issue.9

  4. Open Affects: Everyone

    Blue screen exception

    After installing this update and restarting, a blue screen with error code 0x18B might appear.10

    How to apply the workaround Workaround

    KB5055627 is listed as addressing this issue.10

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-04-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5053656, KB5053598, KB5052093, KB5051987
+15 earlier KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5058411
VersionBuildChannel
24H2 26100.3775 General availability

Security

68 vulnerabilities fixed
1 exploited 5 critical 63 important
VulnerabilitySeverityCVSS
CVE-2025-29824 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2023-40547
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
 Critical 8.3
CVE-2025-26663
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26670
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-26686
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 7.5
CVE-2025-27491
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.1
CVE-2024-21302
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
 Important 6.7

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 68 vulnerabilities →

Updated components

1,440 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display32
Security and sign-in17
Hyper-V and virtualization15
Settings15
Kernel13
Remote Desktop12
Networking11
Storage and file systems11
File Explorer and shell10
Secure Boot9
Bluetooth3
Printing3

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. Update for the Aysen region in Chile to support the government DST change order in 2025. support.microsoft.com
  2. 2. Windows Hello facial recognition requires color cameras to see a visible face when signing in. support.microsoft.com
  3. 3. Image Search | 1.7.820.0 support.microsoft.com
  4. 4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  5. 5. This issue occurred particularly when Kerberos was used and Credential Guard was enabled, potentially causing user authentication problems. support.microsoft.com
  6. 6. After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted support.microsoft.com
  7. 7. Increasing the display scaling improves clarity by enhancing text rendering. support.microsoft.com
  8. 8. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  9. 9. This issue is addressed in KB5055627. support.microsoft.com
  10. 10. After installing this update and restarting your device, you might encounter a blue screen exception with error code 0x18B support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake