Skip to the content
The Update Bureau
Windows 11 24H2 Windows 11 24H2 Security update
Patch Tuesday Zero-day

KB5058411

KB5058411: Cumulative update for Windows 11, version 24H2, May 2025. Exploited scripting and Windows driver flaws patched; mic audio fixed

In short

Patches exploited flaws in the scripting engine and Windows drivers, and addresses microphone muting and an eye controller app that would not launch. A restart may be needed.

Does it affect you? Applies to: Devices running Windows 11, version 24H2. The listed AI component updates apply only to Copilot+ PCs.

Build
26100.4061
Security
39 fixed · 3 critical · 5 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 3 changes

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package

For: devices using Linux with EFI

  • Linux system detection gets improvements.1
    The update applies improvements to SBAT for the detection of Linux systems.

AI components

Verified in package
  • Three AI components are updated on Copilot+ PCs.2
    Image Search, Content Extraction, and Semantic Analysis are updated to version 1.7.824.0. These components apply only to Windows Copilot+ PCs.

Servicing stack

  • The component that installs Windows updates gets quality improvements.3
    The update includes servicing stack update KB5058523, build 26100.4060.

Fixes 2 changes

Audio

Verified in package
  • The update addresses cases where microphone audio might mute unexpectedly.4

Eye controller

  • The eye controller app launches after cases where it would not start.4

Known issues

  1. Open Affects: Everyone

    Noto fonts issue

    CJK text might look blurry or unclear at 96 DPI (100% scaling) in Chromium-based browsers, including Edge and Chrome.5

    How to apply the workaround Workaround

    Increase display scaling to improve text clarity. Microsoft also suggests reporting Noto CJK font issues through the Google Noto Fonts GitHub repository.5

  2. Open Affects: Organizations and IT administrators

    Print to PDF might not work

    Enterprise customers might find Microsoft Print to PDF missing from Settings, or see error 0x800f0922 when enabling it.6

    How to apply the workaround Workaround

    Try enabling Microsoft Print to PDF in Windows Features, or run the PowerShell commands below. The final command might return error 0x800f0922.6

    Step-by-step instructions, command & download kit
    2 steps powershell.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Open PowerShell as administrator.
    2. Run the commands in order.
    powershell.exe · Administrator 
    > Disable-WindowsOptionalFeature -Online -FeatureName Printing-PrintToPDFServices-Features> Enable-WindowsOptionalFeature -Online -FeatureName Printing-PrintToPDFServices-Features

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-05-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5055627, KB5059087, KB5055523, KB5053656
+18 earlier KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5061977
VersionBuildChannel
24H2 26100.4061 General availability

Security

39 vulnerabilities fixed
5 exploited 3 critical 36 important
VulnerabilitySeverityCVSS
CVE-2025-30400 Exploited
Microsoft DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32701 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32706 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32709 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-30397 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2025-29966
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29967
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29833
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
 Critical 7.7

The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 39 vulnerabilities →

Updated components

1,701 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings45
Bluetooth40
Graphics and display30
Security and sign-in20
Audio18
Networking16
File Explorer and shell15
Search13
Remote Desktop12
Kernel11
Hyper-V and virtualization8
Secure Boot8

Verified in package: changed files confirm Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI), AI components, Audio.

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. [Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies improvements to SBAT for the detection of Linux systems. support.microsoft.com
  2. 2. Image Search 1.7.824.0 Content Extraction 1.7.824.0 Semantic Analysis 1.7.824.0 support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. [Audio] Fixed: This update addresses an issue where the audio from your microphone might mute unexpectedly. [Eye controller] Fixed: The eye controller app doesn’t launch. support.microsoft.com
  5. 5. Increasing the display scaling improves clarity by enhancing text rendering. support.microsoft.com
  6. 6. To address this, try enabling the Printing-PrintToPDFServices-Feature using one of the following options: Option 1: Press Windows + R, type optional features, and enable Microsoft Print to PDF in the Windows Features dialog. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake