Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5058405

KB5058405: Cumulative update for Windows 11, version 23H2, May 2025. Scripting Engine flaw exploited; recovery errors hit virtual PCs

In short

An exploited Scripting Engine flaw is among the security fixes. Some virtual machines might fail to start during installation; affected IT teams should use KB5062170 instead if they have not deployed this update.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, including x64 and Arm64 systems.

Build
22631.5335
Security
38 fixed · 3 critical · 5 exploited
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • Does it affect you? This update applies to Windows 11, versions 22H2 and 23H2.
  • In detail The resolved upgrade-download issue affected attempts to update to version 24H2 via WSUS.
  • Known issues The reported blurry CJK text affects Chromium-based browsers at 96 DPI (100% scaling).

The official sources are linked at the end of the page.

What changes

Improvements 3 changes

Windows 11, version 23H2

  • This build includes the improvements released for version 22H2.1

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package

For: devices that use Linux

  • Linux systems are detected more reliably during Secure Boot checks.2
    Applies improvements to SBAT for Linux system detection.

Servicing stack

  • The component that installs Windows updates gets quality improvements.3
    The update includes servicing stack update KB5058528, build 22621.5334.

Fix 1 change

Windows Update

Verified in package

For: company-managed devices using WSUS

  • Some company-managed PCs can upgrade to version 24H2 after a download problem that could stop the process or show an error.4
    Addresses a WSUS upgrade issue with error code 0x80240069 and logs stating "Service has unexpectedly stopped".

Known issues

  1. Open Affects: Everyone

    Noto fonts issue

    Chinese, Japanese, or Korean text might look blurry in Edge, Chrome, and other browsers at 100% display scaling.5

    How to apply the workaround Workaround

    Increase display scaling to improve text clarity.5

  2. Open Affects: Everyone

    Recovery error with error code 0xc0000098

    Some devices might show a repair error with code 0xc0000098 during installation and fail to start. This has affected a small number of physical devices, but mostly virtual machines.6

    How to apply the workaround Workaround

    If the update is not deployed yet in a virtual desktop environment, use KB5062170 instead. If Windows will not start, recover the device, then install KB5062170.6

    Step-by-step workaround instructions
    6 steps
    Show steps Hide steps
    Step-by-step procedure
    1. For a device with Windows Recovery enabled, open the Windows Recovery Environment, then restart Windows.
    2. For a device without Recovery enabled, mount its virtual hard disk from a remote device.
    3. Attach the virtual hard disk as a data disk to another virtual machine or device, then return it to the affected machine.
    4. Restart Windows normally; this reverts Windows to the last successfully installed update.
    5. For Azure devices, follow the repair steps in the Azure virtual machine repair guidance.
    6. After recovery, install KB5062170 from the Microsoft Update Catalog.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-05-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5055629, KB5058919, KB5055528, KB5053657
+28 earlier KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5062170
VersionBuildChannel
23H2 22631.5335 General availability

Security

38 vulnerabilities fixed
5 exploited 3 critical 35 important
VulnerabilitySeverityCVSS
CVE-2025-30400 Exploited
Microsoft DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32701 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32706 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32709 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-30397 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2025-29966
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29967
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29833
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
 Critical 7.7

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 38 vulnerabilities →

Updated components

1,261 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings43
Bluetooth38
Windows Update21
File Explorer and shell14
Graphics and display12
Security and sign-in12
Remote Desktop11
Networking10
Kernel7
Emoji and input6
Hyper-V and virtualization6
Audio5

Verified in package: changed files confirm Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI), Windows Update.

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This build includes all the improvements in Windows 11, version 22H2. support.microsoft.com
  2. 2. This update applies improvements to SBAT for the detection of Linux systems. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. Fixed: This update addresses an issue where you might be unable to update to Windows 11, version 24H2 via WSUS. The download might not start or complete, showing error code 0x80240069 support.microsoft.com
  5. 5. Increasing the display scaling improves clarity by enhancing text rendering. support.microsoft.com
  6. 6. If you experienced this issue and are unable to start Windows, try the following steps to recover your device. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake