Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5068865

KB5068865: Cumulative update for Windows 11, version 23H2, November 2025. HTTP request parsing tightened; kernel flaw exploited

In short

Fixes an HTTP.sys request-parsing issue and addresses 33 vulnerabilities, including an actively exploited Windows Kernel flaw. It also includes improvements to the servicing stack.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, receive this update. The end-of-updates date of November 10, 2026 applies to the Enterprise and Education editions.

Build
22631.6199
Security
33 fixed · 2 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What to do Windows Updates do not include Microsoft Store app updates. Enterprise users should use Microsoft’s Configuration Manager guidance; consumers can get app updates through Microsoft Store.

The official sources are linked at the end of the page.

What changes

Fix 1 change

Networking

Verified in package
  • HTTP requests are parsed correctly when front-end proxies are involved, avoiding a parsing discrepancy caused by a single line break in chunk extensions.1
    Fixes the HTTP.sys request parser accepting a single line break in HTTP/1.1 chunk extensions, where RFC 9112 requires CRLF. Strict parsing can be enabled at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Http\Parameters by setting HttpAllowLenientChunkExtParsing to 0.

Improvement 1 change

Servicing stack

  • The component that installs Windows updates gets quality improvements to help devices receive and install updates.2
    Includes servicing stack update KB5068070, build 22621.6120.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-11-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5067112, KB5066793, KB5065790, KB5065431
+42 earlier KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5071417
VersionBuildChannel
23H2 22631.6199 General availability

Security

33 vulnerabilities fixed
1 exploited 2 critical 31 important
VulnerabilitySeverityCVSS
CVE-2025-62215 Exploited
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-60724
Windows GDI+ Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-60716
DirectX Graphics Kernel Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 33 vulnerabilities →

Updated components

731 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop28
Graphics and display18
Networking9
Kernel7
Secure Boot5
Hyper-V and virtualization4
Security and sign-in4
File Explorer and shell3
Bluetooth2

Verified in package: changed files confirm Networking.

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. Fixed: This update fixes an issue in the HTTP.sys request parser, a Windows component that reads and processes HTTP requests. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake