The Update BureauKB5049993: Cumulative update for Windows Server, version 2016, January 2025. Windows OLE remote-code-execution flaw among critical fixes
Addresses 111 vulnerabilities, including 8 critical flaws. It also adds at-risk drivers to the vulnerable driver blocklist; USB audio problems are resolved by KB5052006.
Does it affect you? Applies to: Devices running Windows Server 2016 x64.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Improvement 1 change
Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)
-
The vulnerable driver blocklist covers more drivers that attackers could abuse by bringing their own vulnerable driver.1
Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to
DriverSiPolicy.p7b.
Known issues
-
After installing this security update, you might experience issues with USB audio devices.
USB audio devices might stop working and prevent audio playback, especially when the setup uses a USB 1.0 audio driver-based digital-to-analog converter. KB5052006 addresses this issue.2
Resolution Fixed in KB5052006Install KB5052006 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-01-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5048671, KB5046612, KB5037423
- Replaced by
- KB5052006
| Version | Build | Channel |
|---|---|---|
| 2016 | 14393.7699 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows OLE Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows Remote Desktop Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Microsoft Digest Authentication Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Remote Desktop Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Remote Desktop Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
BranchCache Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Themes Spoofing Vulnerability
|
Important | 6.5 |
The table lists the 9 exploited, publicly disclosed or critical vulnerabilities. See all 111 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
310 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Networking | 12 |
| Secure Boot | 8 |
| Security and sign-in | 7 |
| .NET runtime (CLR) | 6 |
| Hyper-V and virtualization | 6 |
| File Explorer and shell | 5 |
| Kernel | 5 |
| Search | 5 |
| Graphics and display | 3 |
| Storage and file systems | 3 |
| Audio | 1 |
| Emoji and input | 1 |
Verified in package: changed files confirm Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b).
Sources
Cited passages from Microsoft's official notes (2)
-
1.
This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.
support.microsoft.com -
2.
This issue is addressed in KB5052006.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 21, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake