Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday Zero-day

KB5058379

KB5058379: Cumulative update for Windows 10, versions 21H2 and 22H2, May 2025. Exploited scripting and Windows privilege flaws patched

In short

The update fixes 36 vulnerabilities, including five that attackers are already exploiting. It also improves Linux-system detection and servicing, but the update is no longer available.

Does it affect you? Applies to: Windows 10, version 22H2, build 19045.5854, and Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021, version 21H2, build 19044.5854.

Builds
19044.5854 · 19045.5854
Security
36 fixed · 3 critical · 5 exploited
Review notes Additional details from the official release notes (2) Read notes
  • What changes The 21H2 improvement applies to Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021.
  • In detail After October 14, 2025, Microsoft no longer provides free software updates from Windows Update, technical assistance, or security fixes for Windows 10.

The official sources are linked at the end of the page.

What changes

Improvements 3 changes

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

For: devices running Windows 10, version 21H2

  • Detection of Linux systems is improved.1
    Improves SBAT for detecting Linux systems.

Windows 10, version 22H2

For: devices running Windows 10, version 22H2

  • The 22H2 build includes the improvements listed for the supported 21H2 editions; no additional issues are documented for this release.2

Servicing stack

  • The component that installs Windows updates receives quality improvements.3
    The update includes servicing stack update KB5058526, builds 19044.5853 and 19045.5853.

Known issues

  1. Open Affects: Everyone

    Noto fonts

    CJK text might look blurry or unclear at 96 DPI in Chromium-based browsers, including Microsoft Edge and Google Chrome. Increasing display scaling improves clarity.4

    How to apply the workaround Workaround

    Increase display scaling to improve clarity; users can also report Noto CJK font issues through Google's GitHub repository.4

  2. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent version 2411 might be unable to complete installation of the January 2025 Windows security update and might roll back to their previous updates. This issue is about the January update, not KB5058379; home users are not expected to be affected.5

    How to apply the workaround Workaround

    Install Citrix Session Recording Agent version 2503 or newer.5

  3. Resolved Affects: Everyone Resolved by KB5061768

    BitLocker recovery screen

    On devices with Intel TXT enabled on 10th-generation or later Intel vPro processors, KB5058379 might cause lsass.exe to terminate unexpectedly and trigger Automatic Repair. With BitLocker enabled, this can lead to a recovery-key prompt or, in some cases, a reboot loop. KB5061768 and later updates resolve the issue; consumer devices are less likely to be affected.6

    Resolution Fixed in KB5061768

    Install KB5061768 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-05-13
Type
Cumulative update
VersionBuildChannel
21H2 19044.5854 General availability
22H2 19045.5854 General availability

Security

36 vulnerabilities fixed
5 exploited 3 critical 33 important
VulnerabilitySeverityCVSS
CVE-2025-30400 Exploited
Microsoft DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32701 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32706 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32709 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-30397 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2025-29966
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29967
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29833
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
 Critical 7.7

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 36 vulnerabilities →

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This update applies improvements to SBAT for the detection of Linux systems. support.microsoft.com
  2. 2. This build includes all the improvements from the supported Windows 10, version 21H2 editions. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. Increasing the display scaling improves clarity by enhancing text rendering. support.microsoft.com
  5. 5. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. support.microsoft.com
  6. 6. This issue was resolved by Windows updates released May 19, 2025 (KB5061768), and later. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake