Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday Zero-day

KB5053594

KB5053594: Cumulative update for Windows Server, version 2016, March 2025. Exploited kernel, NTFS and FAT flaws addressed

In short

Addresses actively exploited flaws in Windows, including kernel, NTFS and FAT vulnerabilities, and adds safer temporary-file storage for system processes.

Does it affect you? Applies to: Devices running Windows Server 2016, x64.

Build
14393.7876
Security
34 fixed · 5 critical · 6 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 2 changes

Temporary files

  • System processes can store temporary files in a protected folder, reducing the risk of unauthorized access.1
    The directory is C:\Windows\SystemTemp; processes can use the GetTempPath2 API or .NET's GetTempPath API.

Daylight saving time (DST)

For: Devices using Paraguay time

  • Daylight-saving-time changes for Paraguay are included.2

Fix 1 change

Use-after-free (UAF) risk

  • Process creation no longer has the reported risk of using freed memory.3
    Fixes a race condition that might lead to a use-after-free (UAF) risk during process creation.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-03-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5055521
VersionBuildChannel
2016 14393.7876 General availability

Security

34 vulnerabilities fixed
6 exploited 5 critical 29 important
VulnerabilitySeverityCVSS
CVE-2025-24985 Exploited
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24993 Exploited
Windows NTFS Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24983 Exploited
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.0
CVE-2025-26633 Exploited
Microsoft Management Console Security Feature Bypass Vulnerability
 Important 7.0
CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 4.6
CVE-2025-26645
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2024-49116
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24035
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24045
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24064
Windows Domain Name Service Remote Code Execution Vulnerability
 Critical 8.1

The table lists the 11 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →

Updated components

538 files changed since the previous update for the same versions.

Top changed componentsFiles
Audio9
Graphics and display6
Hyper-V and virtualization5
Kernel4
Search4
File Explorer and shell3
Security and sign-in2
Settings2
Storage and file systems2
Networking1
Remote Desktop1
Secure Boot1

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This update enables system processes to store temporary files in a secure directory "C:\Windows\SystemTemp" via either calling GetTempPath2 API or using .NET's GetTempPath API, thereby reducing the risk of unauthorized access. support.microsoft.com
  2. 2. Updated: DST changes for Paraguay. support.microsoft.com
  3. 3. Fixed: A race condition might lead to a UAF risk during process creation. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake