Skip to the content
The Update Bureau
Windows 10 1809 Windows 10 1809 Security update
Patch Tuesday Zero-day

KB5066586

KB5066586: Cumulative update for Windows 10, version 1809, October 2025. Exploited modem and Remote Access flaws fixed; file previews blocked

In short

Addresses 92 vulnerabilities, including flaws reported as exploited, and changes File Explorer so it disables previews of files downloaded from the internet. Review the Secure Boot certificate guidance and prepare for upcoming expirations.

Does it affect you? Applies to: Devices running Windows 10, version 1809: Windows 10 Enterprise LTSC 2019, Windows 10 IoT Enterprise LTSC 2019, and Windows 10 IoT Core LTSC.

Build
17763.7919
Security
92 fixed · 2 critical · 3 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 3 changes

Cryptography

  • RSA-based smart card certificates now require a different storage provider; some smart card authentication might have problems as a result.1
    Requires Key Storage Provider (KSP) instead of Cryptographic Service Provider (CSP) for RSA-based smart card certificates.

File Explorer

  • File Explorer automatically disables previews for files downloaded from the internet, helping prevent a vulnerability when potentially unsafe files are previewed.2

Servicing stack

  • The update includes a servicing stack improvement intended to make the Windows update installation process more reliable.3
    The combined package includes servicing stack update KB5066585, version 17763.7912.

Fixes 3 changes

Input and Composition

2 items
  • The Chinese input method no longer displays private Unicode characters incorrectly, and the characters meet the GB18030 standard.4
    Fixes the issue with the Chinese Input Method Editor (IME) and private Unicode characters.
  • Surrogate pairs no longer appear as empty boxes when a text field reaches its length limit.5
    Fixes the issue affecting USER32 Edit controls.

Windows Remote Management (WinRM)

For: devices using PowerShell Remoting or WinRM

  • PowerShell Remoting and WinRM commands no longer time out after 600 seconds.6

Removal 1 change

Fax modem driver

For: devices with fax modem hardware that depends on this driver

  • Fax modem hardware that depends on the ltmdm64.sys driver no longer works in Windows.7
    The ltmdm64.sys driver is removed.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-10-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5065428, KB5066187, KB5063877, KB5062557
+7 earlier KB5060531, KB5061978, KB5058392, KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5068791
VersionBuildChannel
1809 17763.7919 General availability

Security

92 vulnerabilities fixed
3 exploited 2 critical 90 important
VulnerabilitySeverityCVSS
CVE-2025-24990 Exploited
Windows Agere Modem Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-59230 Exploited
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-47827 Exploited
MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11
 Important 4.6
CVE-2025-49708
Microsoft Graphics Component Elevation of Privilege Vulnerability
 Critical 9.9
CVE-2016-9535
MITRE CVE-2016-9535: LibTIFF Heap Buffer Overflow Vulnerability
 Critical 4.0
CVE-2025-24052
Windows Agere Modem Driver Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 6 exploited, publicly disclosed or critical vulnerabilities. See all 92 vulnerabilities →

Updated components

982 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display18
Networking16
Hyper-V and virtualization11
Secure Boot9
Search8
Storage and file systems8
Kernel7
Bluetooth6
File Explorer and shell6
Printing6
Remote Desktop6
Security and sign-in6

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. support.microsoft.com
  2. 2. After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. Fixed: An issue with the Chinese Input Method Editor (IME). Private Unicode characters were shown incorrectly and did not meet GB18030 standard. support.microsoft.com
  5. 5. Fixed: An issue that affects USER32 Edit controls. Surrogate pairs appear as empty boxes when text fields reach their length limit. support.microsoft.com
  6. 6. Fixed: An issue that affects PowerShell Remoting and WinRM in which commands time out after 600 seconds. support.microsoft.com
  7. 7. This update removes the ltmdm64.sys driver. Fax modem hardware dependent on this specific driver will no longer work in Windows. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake