Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5058392

KB5058392: Cumulative update for Windows 10, version 1809, May 2025. Exploited CLFS driver and DWM flaws patched

In short

Addresses 36 vulnerabilities, including three critical flaws and five that attackers are exploiting. It also improves Linux detection through Secure Boot and addresses a blue-screen error.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809, for x86 or x64. The update brings the OS build to 17763.7314.

Build
17763.7314
Security
36 fixed · 3 critical · 5 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 4 changes

OS Security

Verified in package
  • The blocklist includes more vulnerable drivers, helping prevent their use in attacks.1
    Updates the Windows Kernel Vulnerable Driver Blocklist (DriverSiPolicy.p7b) with drivers with security vulnerabilities used in Bring Your Own Vulnerable Driver (BYOVD) attacks.

GRFX-Graphics

  • Addresses a blue-screen error that can occur in cases linked to recent GDI updates and CHS GB18030-2022 fonts.2
    Corruption occurs while the associated thread remains active, leading to an error message.

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package

For: devices that detect Linux systems

  • Linux system detection improves.3
    Applies improvements to SBAT for the detection of Linux systems.

Servicing stack

  • The component that installs Windows updates receives quality improvements.4
    The cumulative update includes servicing stack update KB5058525, build 17763.7313.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent (SRA) version 2411 might fail to complete installation of the January 2025 Windows security update and roll back during restart. Home users are not expected to be affected.5

    How to apply the workaround Workaround

    Upgrade Citrix SRA to version 2503 or newer; version 2503 was released April 28, 2025.5

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-05-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5061978
VersionBuildChannel
1809 17763.7314 General availability

Security

36 vulnerabilities fixed
5 exploited 3 critical 33 important
VulnerabilitySeverityCVSS
CVE-2025-30400 Exploited
Microsoft DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32701 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32706 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32709 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-30397 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2025-29966
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29967
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29833
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
 Critical 7.7

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 36 vulnerabilities →

Updated components

766 files changed since the previous update for the same versions.

Top changed componentsFiles
Bluetooth36
Settings25
Secure Boot15
Security and sign-in14
File Explorer and shell10
Networking9
Graphics and display8
Remote Desktop8
Kernel7
Hyper-V and virtualization5
Emoji and input4
Printing4

Verified in package: changed files confirm OS Security, Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI).

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. Updates to the Windows Kernel Vulnerable Driver Blocklist (DriverSiPolicy.p7b). Additions have been made to blocklist drivers with security vulnerabilities that have been used in Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  2. 2. This update addresses an issue causing an error message on a blue screen particularly in cases linked to recent GDI updates with CHS GB18030-2022 fonts. support.microsoft.com
  3. 3. This update applies improvements to SBAT for the detection of Linux systems. support.microsoft.com
  4. 4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  5. 5. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake