Skip to the content
The Update Bureau
Windows 11 24H2 / 25H2 Windows 11 24H2 / 25H2 Security update
Patch Tuesday

KB5089549

KB5089549: Cumulative update for Windows 11, versions 24H2 and 25H2, May 2026. Critical DNS Client flaw patched; BitLocker startup risk reduced

In short

A critical DNS Client code-execution flaw is among the security fixes, and boot-file updates are less likely to trigger BitLocker recovery. Devices with little EFI partition space might fail installation.

Does it affect you? Applies to: Devices running Windows 11, version 25H2 (build 26200.8457) or version 24H2 (build 26100.8457), on x64 or Arm64.

Builds
26100.8457 · 26200.8457
Security
61 fixed · 4 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • Known issues The installation issue is addressed in KB5089573.
  • Known issues Devices with limited free space on the EFI System Partition might fail installation; the risk is especially notable at 10 MB or less.

The official sources are linked at the end of the page.

What changes

Improvements 6 changes

Secure Boot

Gradual rollout Verified in package
  • More eligible devices can receive new Secure Boot certificates through a phased rollout.1
    Devices receive the certificates only after showing sufficient successful update signals.

Boot manager servicing update

  • Devices are more likely to start normally after boot file updates, without entering BitLocker recovery.2

Connectivity

  • SSDP notifications are more reliable, helping prevent the service from becoming unresponsive.3
    Improves Simple Service Discovery Protocol (SSDP) notification reliability.

Daylight saving time (DST)

For: devices using Egypt's time zone

  • The update supports Egypt's 2023 daylight saving time change.4

AI components

Verified in package
  • AI components are updated on Copilot+ PCs.5
    The updated components are Image Search, Content Extraction, Semantic Analysis, and Settings Model. These components do not install on Windows PCs that are not Copilot+ PCs or on Windows Server.

Servicing stack

  • The component that installs Windows updates gets quality improvements.6
    The combined package includes servicing stack update KB5092762, build 26100.8456.

Fix 1 change

Boot manager servicing update

Verified in package

For: devices with certain TPM validation settings

  • This update addresses a problem that could send some devices into BitLocker recovery after boot file updates.7
    The issue can occur with certain Trusted Platform Module (TPM) validation settings, including invalid PCR7 configurations, after installing the April 2026 security update.

New feature 1 change

Secure Boot

Verified in package
  • Eligible devices get a new folder with example scripts for organizations that manage updates across many devices.8
    The C:\Windows\SecureBoot folder contains scripts to check certificate update status and automate deployment in an Active Directory environment.

Known issues

  1. Open Affects: Everyone

    May 2026 security update fails to install with error 0x800f0922

    Some devices with 10 MB or less free on the EFI System Partition might fail installation with error 0x800f0922 and roll back the update.9

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-05-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5083631, KB5083769, KB5086672, KB5079391
+50 earlier KB5085516, KB5079473, KB5077241, KB5077181, KB5074105, KB5078127, KB5077744, KB5074109, KB5072033, KB5070311, KB5068861, KB5067036, KB5070773, KB5066835, KB5065789, KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5094126
VersionBuildChannel
24H2 26100.8457 General availability
25H2 26200.8457 General availability

Security

61 vulnerabilities fixed
4 critical 57 important
VulnerabilitySeverityCVSS
CVE-2026-41096
Windows DNS Client Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-40403
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-35421
Windows GDI Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-32161
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 61 vulnerabilities →

Updated components

2,955 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings114
Graphics and display37
Security and sign-in22
File Explorer and shell21
Networking18
Search16
Printing14
Remote Desktop14
Hyper-V and virtualization11
Emoji and input8
Kernel7
Secure Boot7

Verified in package: changed files confirm Secure Boot, AI components, Boot manager servicing update.

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. support.microsoft.com
  2. 2. This update improves startup reliability after boot file updates, so devices start normally without entering BitLocker recovery. support.microsoft.com
  3. 3. This update improves the reliability of Simple Service Discovery Protocol (SSDP) notifications to help prevent the service from becoming unresponsive. support.microsoft.com
  4. 4. This update supports the 2023 DST change for the Arab Republic of Egypt. support.microsoft.com
  5. 5. This release updates the following AI components: support.microsoft.com
  6. 6. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  7. 7. This update addresses an issue where some devices might enter BitLocker Recovery after updating boot files on systems with certain Trusted Platform Module (TPM) validation settings, including invalid PCR7 (Platform Configuration Register 7) configurations. support.microsoft.com
  8. 8. This update adds a new SecureBoot folder under C:\Windows on eligible devices. support.microsoft.com
  9. 9. some devices might fail to complete installation with error code 0x800f0922. This issue occurs on devices that have limited free space on the EFI System Partition (ESP), especially if it has 10 MB or less available. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake