Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday Zero-day

KB5048667

KB5048667: Cumulative update for Windows Server, version 2025, December 2024. Actively exploited Common Log File System flaw addressed

In short

The update addresses an actively exploited flaw in the Common Log File System Driver. It covers 57 vulnerabilities, including 15 critical ones.

Does it affect you? Applies to: Devices running Windows Server 2025, build 26100.2605.

Build
26100.2605
Security
57 fixed · 15 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Does it affect you? This update is for Windows Server 2025 and brings the OS to build 26100.2605.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 11.

What changes

Improvements 2 changes

Internal OS functionality

  • Parts of the operating system get security improvements.1
    The update makes miscellaneous security improvements to internal OS functionality.

Servicing stack

  • The component that installs Windows updates gets quality improvements.2
    Includes servicing stack update KB5049685, build 26100.2592.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-12-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5046617, KB5043080, KB5044284
Replaced by
KB5050009
VersionBuildChannel
2025 26100.2605 General availability

Security

57 vulnerabilities fixed
1 exploited 15 critical 42 important
VulnerabilitySeverityCVSS
CVE-2024-49138 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-49112
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-49117
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2024-49105
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.4
CVE-2024-49106
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49108
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49115
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49116
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49118
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49119
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49122
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49123
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49124
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49126
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49127
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-49132
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2024-43583
Winlogon Elevation of Privilege Vulnerability
 Important 7.8

The table lists the 17 exploited, publicly disclosed or critical vulnerabilities. See all 57 vulnerabilities →

Updated components

7,026 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings130
Graphics and display59
Networking44
Bluetooth41
Printing40
Audio35
Hyper-V and virtualization35
Security and sign-in33
Remote Desktop28
Windows Update28
.NET networking26
File Explorer and shell26

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. This update makes miscellaneous security improvements to internal OS functionality. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake