KB5058385: Cumulative update for Windows Server, version 2022, May 2025. Critical Remote Desktop flaws patched; remote-session screen issue addressed

Addresses 42 vulnerabilities, including five critical flaws and five already exploited. It also addresses problems that could cause black screens during Remote Desktop sessions or prevent a new console session from starting.

Does it affect you? Applies to: Devices running Windows Server 2022, including the x64 build 20348.3692.

What changes

Improvements 3 changes

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package

For: Devices using Linux systems

Linux system detection through Secure Boot Advanced Targeting is improved.¹
Applies improvements to SBAT for the detection of Linux systems.

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package

The vulnerable driver blocklist includes additional drivers at risk of being used in attacks.²
Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to DriverSiPolicy.p7b.

Servicing stack

The update improves the component that installs Windows updates.³
Includes servicing stack update KB5058531, build 20348.3691.

Fixes 2 changes

Desktop Windows Manager (DVM)

For: Devices using remote sessions

The update addresses an issue that could cause a black or gray screen when a remote session connects or disconnects.⁴
The Desktop Window Manager could stop responding because of an access error in dwmredir.dll during a remote session.

Graphics kernel

Verified in package

For: Devices starting a new console session

The update addresses a problem that could prevent a new console session from starting after the previous session closes.⁵

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-05-13
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5059092, KB5058920, KB5055526, KB5053603

+18 earlier
KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by: KB5061906

Version	Build	Channel
2022	20348.3692	General availability

Security

42 vulnerabilities fixed

5 exploited 5 critical 37 important

Vulnerability	Severity	CVSS
CVE-2025-30400 Exploited Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-32701 Exploited Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-32706 Exploited Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-32709 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2025-30397 Exploited Scripting Engine Memory Corruption Vulnerability	Important	7.5
CVE-2025-29966 Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8
CVE-2025-29967 Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8
CVE-2024-49128 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2025-32710 Windows Remote Desktop Services Remote Code Execution Vulnerability	Critical	8.1
CVE-2025-29833 Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability	Critical	7.7

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 42 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022

392.6 MB

windows10.0-kb5058385-x64.msu Main update · KB5058385 SHA-1: 344c2309…b006cb

Updated components

549 files changed since the previous update for the same versions.

Top changed components	Files
Settings	18
Bluetooth	14
Networking	13
Graphics and display	11
Security and sign-in	10
Hyper-V and virtualization	8
Secure Boot	8
File Explorer and shell	5
Kernel	5
Remote Desktop	5
Search	5
Printing	4

Verified in package: changed files confirm Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI), Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b), Graphics kernel.

Sources

Microsoft Support: KB5058385

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (5)

1. [Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies improvements to SBAT for the detection of Linux systems support.microsoft.com
2. [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
4. [Desktop Windows Manager (DVM)] Fixed: This update addresses an issue that affects the DWM, where it stops responding due to an access error in dwmredir.dll during remote session while connection or disconnection, resulting in a black or grey screen. support.microsoft.com
5. [Graphics kernel] Fixed: This update addresses an issue that occurs when starting a new console session after closing the previous one, and the new session doesn't start successfully. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake