Skip to the content
The Update Bureau
Windows 11 24H2 Windows 11 24H2 Security update
Patch Tuesday Zero-day

KB5060842

KB5060842: Cumulative update for Windows 11, version 24H2, June 2025. Exploited shortcut-file flaw patched; restore points limited to 60 days

In short

An actively exploited Internet Shortcut Files flaw is patched, and restore points now expire after 60 days. Restart if prompted.

Does it affect you? Applies to: Devices running Windows 11, version 24H2, including x64 and Arm64 devices.

Build
26100.4349
Security
35 fixed · 2 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues Microsoft says the Print to PDF issue is addressed in KB5060829.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 3 changes

System Restore

  • Restore points are kept for up to 60 days. Older restore points are not available.1
    The 60-day limit applies to Windows 11, version 24H2, and will also apply to future versions of 24H2.

AI components

  • AI components receive updated versions on Copilot+ PCs.2
    Image Search, Content Extraction, and Semantic Analysis are updated to version 1.2505.838.0. These components apply only to Copilot+ PCs.

Servicing stack

  • The component that installs Windows updates receives quality improvements.3
    Includes servicing stack update KB5059502, build 26100.4193.

Fix 1 change

Windows Hello

For: Windows Hello for Business users using the Key Trust model

  • Windows Hello for Business users can sign in with self-signed certificates when they use the Key Trust model.4
    Addresses an issue that prevented sign-in with self-signed certificates using Windows Hello for Business with the Key Trust model.

Known issues

  1. Open Affects: Everyone

    Noto fonts issue

    Chinese, Japanese, or Korean text might look blurry or unclear in Chromium-based browsers at 100% display scaling.5

    How to apply the workaround Workaround

    Increase display scaling to improve text clarity.5

  2. Open Affects: Organizations and IT administrators

    Print to PDF might not work

    Microsoft lists a Print to PDF problem for enterprise customers: the printer might disappear, or enabling its feature might return error 0x800f0922.6

    How to apply the workaround PowerShell

    Try enabling Microsoft Print to PDF in Windows Features, or run the two PowerShell commands. The final command might return error 0x800f0922.6

    Step-by-step instructions, command & download kit
    1 step powershell.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Alternatively, open PowerShell as administrator and run the commands in order.
    powershell.exe · Administrator 
    > Disable-WindowsOptionalFeature -Online -FeatureName Printing-PrintToPDFServices-Features> Enable-WindowsOptionalFeature -Online -FeatureName Printing-PrintToPDFServices-Features
  3. Open Affects: Organizations and IT administrators

    Update delay with deferral policies

    Some devices in organizations using quality-update deferral policies might receive the June 2025 security update later than expected. This affects timing, not the update's quality or applicability.7

    How to apply the workaround Workaround

    Admins can create an expedite policy with Windows Autopatch or adjust deployment rings or deferral settings to reduce the delay.7

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. If the organization uses Windows Autopatch, create an expedite policy to bypass deferral settings.
    2. Alternatively, adjust deployment rings or deferral settings to reduce the delay window.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-06-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5058499, KB5061977, KB5058411, KB5055627
+21 earlier KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5063060
VersionBuildChannel
24H2 26100.4349 General availability

Security

35 vulnerabilities fixed
1 exploited 2 critical 33 important
VulnerabilitySeverityCVSS
CVE-2025-33053 Exploited
Internet Shortcut Files Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-29828
Windows Schannel Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-33070
Windows Netlogon Elevation of Privilege Vulnerability
 Critical 8.1
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
 Important 8.8

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 35 vulnerabilities →

Updated components

1,059 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine54
Graphics and display15
Hyper-V and virtualization15
Networking10
Kernel9
Remote Desktop9
Security and sign-in9
File Explorer and shell8
Storage and file systems8
Secure Boot7
Settings2
SQL Server Agent2

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. After installing the June 2025 Windows security update, Windows 11, version 24H2 will retain system restore points for up to 60 days. support.microsoft.com
  2. 2. This release updates the following AI components: support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. Fixed: This update addresses an issue that prevents users from signing in with self-signed certificates when using Windows Hello for Business with the Key Trust model. support.microsoft.com
  5. 5. There are reports of blurry or unclear CJK (Chinese, Japanese, Korean) text when displayed at 96 DPI (100% scaling) in Chromium-based browsers such as Microsoft Edge and Google Chrome. support.microsoft.com
  6. 6. After installing KB5055627, you might encounter issues with the Microsoft Print to PDF functionality. support.microsoft.com
  7. 7. Some devices in environments where IT admis use quality update (QU) deferral policies might experience delays in receiving the June 2025 Windows security update. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake