Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday

KB5063880

KB5063880: Cumulative update for Windows Server, version 2022, August 2025. Critical GDI+ remote-code flaw patched; Changjie IME fixed

In short

A critical GDI+ flaw could allow remote code execution, and the Changjie Chinese input problem is fixed. Standard users might also see UAC prompts during MSI repairs.

Does it affect you? Applies to: Devices running Windows Server 2022, x64.

Build
20348.4052
Security
56 fixed · 4 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • Known issues Standard users might see unexpected UAC prompts during MSI repair and related operations.
  • Known issues A silent MSI repair can fail when a non-admin user runs an app that initiates the repair.

The official sources are linked at the end of the page.

What changes

Fix 1 change

Input (know issue)

For: Users of the Traditional Chinese Changjie input method

  • The Changjie input method for Traditional Chinese works again after problems with typing, word selection, and the candidate window.1
    Fixes problems with the Microsoft Changjie IME that could occur after installing KB5062572.

Improvement 1 change

Servicing stack

  • The component that installs Windows updates gets quality improvements.2
    Includes servicing stack update KB5062793, build 20348.3920.

Known issues

  1. Open Affects: Everyone

    Unexpected User Account Control (UAC) prompt when doing MSI repair operations

    After this update, standard users might see unexpected UAC prompts during MSI repair and related operations. Silent MSI repairs can fail with an error.3

    How to apply the workaround Workaround

    The page identifies KB5065432 as the update that addresses this issue.3

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-08-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5062572, KB5060526, KB5061906, KB5058385
+22 earlier KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5065432
VersionBuildChannel
2022 20348.4052 General availability

Security

56 vulnerabilities fixed
4 critical 52 important
VulnerabilitySeverityCVSS
CVE-2025-53766
GDI+ Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-53778
Windows NTLM Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2025-50177
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-50176
DirectX Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.8

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 56 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
402.0 MB
windows10.0-kb5063880-x64.msu Main update · KB5063880 SHA-1: 18105d84…3380fb

Updated components

513 files changed since the previous update for the same versions.

Top changed componentsFiles
Bluetooth14
Graphics and display13
Networking8
Security and sign-in8
Hyper-V and virtualization6
Secure Boot6
Kernel4
File Explorer and shell3
Remote Desktop2
Audio1
Printing1
Storage and file systems1

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. Fixed: An issue when using the Microsoft Changjie IME (input method editor) for Traditional Chinese might cause problems such as not being able to form or select words, unresponsive spacebar or blank key, incorrect word output, or a broken candidate window display. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. After installing the update, standard users might see a User Account Control (UAC) prompt in several scenarios. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake