The Update BureauKB5055528: Cumulative update for Windows 11, version 23H2, April 2025. Actively exploited CLFS driver flaw patched; face sign-in tightened
Fixes an actively exploited flaw in the Common Log File System driver. It also changes Windows Hello facial recognition to require a visible face.
Does it affect you? Applies to: Devices running Windows 11, versions 22H2 and 23H2, with builds 22621.5189 and 22631.5189. The WSUS known issue concerns organizations trying to upgrade to version 24H2.
What changes
Improvements 4 changes
Daylight Saving Time (DST)
For: devices in the Aysen region of Chile
- Daylight-saving-time support is updated for the Aysen region in Chile to follow the government's 2025 change.1
Windows Hello
For: devices using Windows Hello facial recognition
-
Facial recognition requires a color camera to see a visible face when you sign in.2
This enhanced-security behavior applies after installing this update or a later Windows update.
OS security
- Internal Windows functionality receives miscellaneous security improvements.3
Servicing stack
-
The component that installs Windows updates receives quality improvements.4
The combined servicing stack update is KB5053665, builds 22621.5120 and 22631.5120.
New feature 1 change
OS Security
-
A new %systemdrive%\inetpub folder is created after installation. Do not delete it, even if Internet Information Services is not enabled.5
The folder is part of changes to increase protection; no action is required.
Known issues
-
Noto fonts issue
CJK text might look blurry or unclear at 96 DPI (100% scaling) in Chromium-based browsers such as Microsoft Edge and Google Chrome.6
How to apply the workaround WorkaroundIncrease display scaling to improve text clarity.6
-
Citrix
Devices with Citrix Session Recording Agent version 2411 might fail to complete installation of the January 2025 Windows security update and revert changes. Home users are not expected to be affected.7
How to apply the workaround WorkaroundUse Citrix Session Recording Agent version 2503 or later; Citrix says these versions resolve the issue.7
-
Windows 11, versions 24H2 might not download via Windows Server Updates Services
On some enterprise-managed devices, Windows 11, version 24H2, might not download through WSUS after installing the April 8, 2025 update or later. The download might not start or finish, and logs can show error 0x80240069.8
How to apply the workaround Group PolicyKB5058405 or later addresses the issue. For devices on an update from before May 13, 2025, an IT administrator can install and configure the special Group Policy; devices with KB5058405 or later do not need it.8
Step-by-step workaround instructionsShow steps Hide steps3 stepsStep-by-step procedure- Check whether the device has KB5058405 or a later update; if so, no special Group Policy is needed.
- For an affected device on an update from before May 13, 2025, have an IT administrator install and configure the special Group Policy.
- Find the policy under
Computer Configuration>Administrative Templates> the Group Policy name.
-
Active Directory Group Policy: Events in local policy
Local Active Directory Group Policy might report that Audit logon events is set to No auditing even when the policy is enabled and logon events are being audited. KB5058919 resolves this reporting issue.9
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
-
Windows Hello
If facial recognition cannot sign you in in low light or with a covered camera lens, this is an intentional security change: Windows Hello now requires a color camera to see a visible face.10
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-04-08
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5053657, KB5053602, KB5052094, KB5051989
- Replaced by
- KB5058919
| Version | Build | Channel |
|---|---|---|
| 23H2 | 22631.5189 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2025-29824
Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Redhat: CVE-2023-40547 Shim - RCE in HTTP boot support may lead to secure boot bypass
|
Critical | 8.3 |
|
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows TCP/IP Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 7.1 |
|
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
|
Important | 6.7 |
The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 68 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
982 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Graphics and display | 32 |
| Remote Desktop | 25 |
| Security and sign-in | 14 |
| Settings | 12 |
| Kernel | 11 |
| Secure Boot | 11 |
| Windows Update | 11 |
| File Explorer and shell | 9 |
| Networking | 8 |
| Storage and file systems | 7 |
| Hyper-V and virtualization | 4 |
| Bluetooth | 2 |
Verified in package: changed files confirm Windows Hello.
Sources
Cited passages from Microsoft's official notes (10)
-
1.
[Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025.
support.microsoft.com -
2.
After installing this update or a later Windows update, for enhanced security, Windows Hello facial recognition requires color cameras to see a visible face when signing in.
support.microsoft.com -
3.
This update makes miscellaneous security improvements to internal OS functionality.
support.microsoft.com -
4.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
5.
After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device.
support.microsoft.com -
6.
Increasing the display scaling improves clarity by enhancing text rendering.
support.microsoft.com -
7.
The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions.
support.microsoft.com -
8.
If you have an enterprise-managed device and have installed the update released May 13, 2025, KB5058405, or later, you do not need to use a Known Issue Rollback (KIR) or a special Group Policy to resolve this issue.
support.microsoft.com -
9.
This issue was resolved by Windows update released April 11, 2025 (KB5058919).
support.microsoft.com -
10.
If you're unable to sign in using Windows Hello facial recognition in low light or with a covered camera lens after installing this update, this is a design change for enhanced security.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake