Skip to the content
The Update Bureau
Windows Server 2019 Windows Server 2019 Security update
Patch Tuesday Zero-day

KB5058392

KB5058392: Cumulative update for Windows Server, version 2019, May 2025. Exploited Scripting Engine and Windows driver flaws patched

In short

The update fixes 42 vulnerabilities, including five exploited flaws, and addresses a blue-screen error tied to certain GDI updates and fonts. A Citrix Session Recording Agent issue can still block installation of the January 2025 security update.

Does it affect you? Applies to: Devices running Windows Server 2019, x64.

Build
17763.7314
Security
42 fixed · 5 critical · 5 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 3 changes

OS Security

Verified in package
  • Windows blocks more vulnerable drivers that have been used in attacks.1
    Updates the Windows Kernel Vulnerable Driver Blocklist (DriverSiPolicy.p7b) with drivers that have security vulnerabilities used in Bring Your Own Vulnerable Driver (BYOVD) attacks.

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package

For: devices that use Linux systems

  • Linux system detection through SBAT gets improvements.2
    Applies improvements to Secure Boot Advanced Targeting (SBAT) for the detection of Linux systems.

Servicing stack

  • The component that installs Windows updates gets quality improvements.3
    The combined servicing stack update is KB5058525, build 17763.7313.

Fix 1 change

GRFX-Graphics

  • The update addresses a blue-screen error associated with recent GDI updates and CHS GB18030-2022 fonts.4
    Corruption occurs while the associated thread remains active.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    This issue affects installation of the January 2025 Windows security update, not KB5058392. Devices with certain Citrix components, including Citrix Session Recording Agent version 2411, might revert the update during restart; home users are not expected to be affected.5

    How to apply the workaround Workaround

    Update Citrix Session Recording Agent to version 2503 or newer.5

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-05-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5059091, KB5058922, KB5050008, KB5037425
Replaced by
KB5061978
VersionBuildChannel
2019 17763.7314 General availability

Security

42 vulnerabilities fixed
5 exploited 5 critical 37 important
VulnerabilitySeverityCVSS
CVE-2025-30400 Exploited
Microsoft DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32701 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32706 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32709 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-30397 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2025-29966
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29967
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2024-49128
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-32710
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-29833
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
 Critical 7.7

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 42 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2019
696.9 MB
windows10.0-kb5058392-x64.msu Main update · KB5058392 SHA-1: 2881b288…f02bd2

Updated components

415 files changed since the previous update for the same versions.

Top changed componentsFiles
Bluetooth18
Settings13
Secure Boot8
Security and sign-in7
File Explorer and shell5
Hyper-V and virtualization5
Networking5
Graphics and display4
Kernel4
Remote Desktop4
Emoji and input2
Printing2

Verified in package: changed files confirm OS Security, Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI).

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. Updates to the Windows Kernel Vulnerable Driver Blocklist (DriverSiPolicy.p7b). Additions have been made to blocklist drivers with security vulnerabilities that have been used in Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  2. 2. This update applies improvements to SBAT for the detection of Linux systems. support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. This update addresses an issue causing an error message on a blue screen particularly in cases linked to recent GDI updates with CHS GB18030-2022 fonts. support.microsoft.com
  5. 5. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake