Skip to the content
The Update Bureau
Windows 11 24H2 / 25H2 Windows 11 24H2 / 25H2 Security update
Patch Tuesday

KB5065426

KB5065426: Cumulative update for Windows 11, versions 24H2 and 25H2, September 2025. Hyper-V and graphics flaws patched; input and audio issues fixed

In short

Critical Hyper-V and graphics security flaws are patched, along with a publicly disclosed SMB flaw. The update also fixes app input and audio problems.

Does it affect you? Applies to: Devices running Windows 11, versions 24H2 or 25H2, on x64 or Arm64.

Builds
26100.6584 · 26200.6584
Security
54 fixed · 8 critical
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What changes The fix reduces the situations in which MSI repairs require UAC prompts. IT administrators can also allowlist specific apps to disable prompts for them.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 5 changes

App compatibility (known issue)

For: Non-admin users and IT administrators

  • Some MSI repairs stop triggering unexpected UAC prompts for non-admin users. IT can allowlist specific apps to disable prompts for them.1
    Addresses UAC prompts during certain MSI custom actions, including configuration or repair during app installation. The fix reduces when prompts are required and enables allowlisting for specific apps.

Input

2 items
  • Some apps no longer stop responding to input in certain input-method situations.2
    Addresses an issue that caused certain apps to stop responding to input in some input method scenarios.
  • IIS modules appear again in IIS Manager, so users can configure IIS through its interface.3
    Addresses missing Internet Information Services modules in IIS Manager.

Kernel

Verified in package
  • Some platforms are less likely to enter an unexpected system state.4
    Addresses an issue that could cause an unexpected system state on some platforms due to an incorrect interrupt state.

Networking (known issue)

Verified in package
  • Audio stutter in apps using NDI stops when Display Capture is on in OBS Studio.5
    Addresses an audio issue in apps using Network Device Interface (NDI) with Display Capture enabled in OBS Studio. It could occur after KB5063878.

Improvements 3 changes

File server

  • Organizations can check for device or software problems with SMB Server signing and EPA before deploying hardening measures.6
    Enables auditing of SMB client compatibility for SMB Server signing and SMB Server EPA.

AI Components

Verified in package

For: Windows Copilot+ PC users

  • Four AI components receive updates on applicable Copilot+ PCs.7
    Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2508.906.0. These components apply only to Windows Copilot+ PCs.

Servicing stack

  • The component that installs Windows updates gets quality improvements.8
    The package includes servicing stack update KB5064531, version 26100.5074.

Known issues

  1. Open Affects: Organizations and IT administrators

    Password icon might be missing or invisible in the lock screen sign-in options

    After KB5064081 or later, the password icon might be invisible in lock-screen sign-in options. The blank button still works; this mainly affects managed or enterprise environments, and is very unlikely on personal Home or Pro devices.9

    How to apply the workaround Workaround

    Install KB5074105 to address the missing or invisible password icon.9

  2. Open Affects: Everyone

    Problems playing protected content in some BluRay/DVD/Digital TV apps

    After KB5064081 or later, some Blu-ray/DVD or Digital TV apps might fail to play protected content. This affects apps using EVR with HDCP enforcement or DRM for digital audio; streaming services are not affected.10

    How to apply the workaround Workaround

    KB5065789 and later updates address some EVR and HDCP playback problems. KB5067036 adds improvements for apps using DRM for digital audio.10

  3. Open Affects: Everyone

    SMBv1 protocol connectivity

    Connections to shared files and folders using SMBv1 over NetBIOS over TCP/IP might fail if either the SMB client or server has the September 2025 security update. SMBv2 and SMBv3 are not affected.11

    How to apply the workaround Workaround

    Install KB5065789 or a later update to address the connection problem.11

  4. Open Affects: Organizations and IT administrators

    PSDirect connections failing in hotpatched devices

    On hotpatched devices with KB5065474 or KB5065426, PowerShell Direct connections might fail when the host and guest virtual machines are not both fully updated.12

    How to apply the workaround Workaround

    Install KB5066360 on both the host and guest virtual machines.12

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-09-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5064081, KB5063878, KB5062660, KB5064489
+29 earlier KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5068221
VersionBuildChannel
24H2 26100.6584 General availability
25H2 26200.6584 General availability

Security

54 vulnerabilities fixed
8 critical 45 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2025-54918
Windows NTLM Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2025-53800
Windows Graphics Component Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2025-55224
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.8
CVE-2025-55228
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2025-55236
Graphics Kernel Remote Code Execution Vulnerability
 Critical 7.3
CVE-2025-48807
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 6.7
CVE-2025-55226
Graphics Kernel Remote Code Execution Vulnerability
 Critical 6.7
CVE-2025-53799
Windows Imaging Component Information Disclosure Vulnerability
 Critical 5.5
CVE-2025-55234
Windows SMB Elevation of Privilege Vulnerability
 Important 8.8

The table lists the 9 exploited, publicly disclosed or critical vulnerabilities. See all 54 vulnerabilities →

Updated components

1,122 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display20
Networking20
Audio11
File Explorer and shell10
Security and sign-in10
Kernel7
Secure Boot6
Settings4
Storage and file systems4
Printing3
Bluetooth2
Emoji and input2

Verified in package: changed files confirm Kernel, Networking (known issue), AI Components.

Sources

Updated
Cited passages from Microsoft's official notes (12)
  1. 1. Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. support.microsoft.com
  2. 2. Fixed: This update addresses an issue that caused certain apps to stop responding input in some input method scenarios. support.microsoft.com
  3. 3. Fixed: This update addresses an issue that caused some Internet Information Services (IIS) modules to disappear from IIS Manager, preventing users from configuring IIS using the IIS Manager interface. support.microsoft.com
  4. 4. Fixed: This update addresses an issue that could cause an unexpected system state on some platforms due to an incorrect interrupt state. support.microsoft.com
  5. 5. Fixed: This update addresses an issue that affects audio in apps using the Network Device Interface (NDI). Audio stutters when Display Capture is on in OBS Studio Application. support.microsoft.com
  6. 6. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already supported by SMB Server. support.microsoft.com
  7. 7. This release updates the following AI components: support.microsoft.com
  8. 8. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  9. 9. This issue is addressed in KB5074105. support.microsoft.com
  10. 10. The non-security September 2025 Windows preview update (KB5065789) and later updates address problems affecting certain applications that use the Enhanced Video Renderer (EVR) with HDCP support.microsoft.com
  11. 11. This issue is addressed in KB5065789. support.microsoft.com
  12. 12. This issue is addressed in KB5066360. If your hotpatched device is experiencing issues with PSDirect connection, we recommend updating both the host and guest VM with these updates. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 12 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake