Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday Zero-day

KB5058411

KB5058411: Cumulative update for Windows Server, version 2025, May 2025. Remote Desktop flaws patched; File Explorer search fixed

In short

Remote Desktop code-execution flaws and several exploited security bugs are addressed. The update also fixes File Explorer search and other problems.

Does it affect you? Applies to: Systems running Windows Server 2025. The update package is for x64 systems.

Build
26100.4061
Security
43 fixed · 5 critical · 5 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 11.

What changes

Fixes 17 changes

Audio

Verified in package
  • Microphone audio no longer mutes unexpectedly.1

Eye controller

For: eye controller users

  • The eye controller app opens again.2

File Explorer

Verified in package 4 items
  • Search results no longer repeat unexpectedly.3
  • A file’s date and time properties no longer change unexpectedly after you copy it.4
  • Details-pane icons update when you change between dark and light themes.5
  • The search box keeps focus as you type.6

Memory leak

  • Predictive input suggestions no longer cause memory leaks.7

Mouse

3 items
  • The mouse pointer no longer disappears when you move it over text fields in some apps.8
  • Turning on pointer trails no longer makes the pointer transparent or adds a black box behind it.9
  • The mouse pointer no longer stutters across the screen, even when system use is low.10

Pinyin Input Method Editor (IME)

For: Pinyin IME users

  • Switching app windows no longer changes the IME language from Chinese to English.11

Snipping Tool

For: users of two or more monitors with different display scaling

  • Screenshots are no longer distorted when you use monitors with different display scaling.12

Task Manager

  • Task Manager closes without staying open longer than expected.13

USB audio device drivers

Verified in package
  • Some external audio devices no longer show a “This device cannot start” error when connected.14
    Fixes the code 10 error with certain external audio management devices.

Wi-Fi

Verified in package
  • The Windows Security dialog no longer stops responding when you sign in to some Wi-Fi networks.15
    The issue could also occur in some other Settings options.

Windows Hello

For: devices with System Guard Secure Launch or DRTM enabled

  • Facial recognition and PIN sign-in work after some PC resets on devices with certain security features enabled.16
    Addresses an edge case after Push button reset or Reset this PC using Keep my Files and Local install, on devices with System Guard Secure Launch or Dynamic Root of Trust for Measurement (DRTM) enabled.

Windows update installation

Verified in package
  • Cumulative updates can install after a feature on demand fails to install.17
    Fixes cumulative update installation error 0x800736b3 when a feature on demand is unable to install.

Improvements 4 changes

Chinese Pinyin Input Method Editor (IME)

Verified in package

For: Chinese Pinyin IME users

  • Bing no longer gives automatic search suggestions for search engines such as Baidu. You can still request suggestions manually.18
    Use Ctrl + Tab or the arrow button to get manual suggestions.

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package
  • The blocklist adds drivers that could be used in attacks.19
    Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to DriverSiPolicy.p7b.

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

Verified in package
  • Linux system detection improves.20
    Applies improvements to SBAT for the detection of Linux systems.

Microsoft RPC Netlogon protocol

For: organizations using Active Directory domain controllers

  • Some remote requests to Active Directory domain controllers now face tighter access checks. This might affect some file and print service software, including Samba.21
    Domain controllers no longer allow anonymous clients to invoke some Netlogon RPC requests, typically related to domain controller location.

New features 2 changes

Fonts

  • A new Chinese font includes the Biangbiang noodles character. Some apps might not show these added characters yet.22
    Simsun-ExtG supports 9,753 ideographs in Unicode Extensions G, H, and I.

Settings

Verified in package
  • You can change time zones in Settings without being an admin.23
    The setting is under Settings > Time & Language > Date & Time.

Known issues

  1. Open Affects: Organizations and IT administrators

    Active Directory Replication

    On Windows Server 2025 domain controllers running the schema master FSMO role, duplicate schema object entries can cause Active Directory replication to fail with a schema mismatch. The issue appears to predate this update and can occur during Exchange Server setup forestprep.24

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Everyone

    Print to PDF might not work

    After installing this update, Microsoft Print to PDF might disappear from the printer list. Enabling the feature might return error 0x800f0922 and prevent the printer driver from installing.25

    How to apply the workaround Workaround

    Try enabling Microsoft Print to PDF in the Windows Features dialog, or use PowerShell to disable and then enable the feature. The final command might return error 0x800f0922.25

    Step-by-step instructions, command & download kit
    2 steps powershell.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Press Windows + R, type optional features, and enable Microsoft Print to PDF in the Windows Features dialog.
    2. Alternatively, open PowerShell as administrator and run the two commands in order.
    powershell.exe · Administrator 
    > Disable-WindowsOptionalFeature -Online -FeatureName Printing-PrintToPDFServices-Features> Enable-WindowsOptionalFeature -Online -FeatureName Printing-PrintToPDFServices

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-05-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5055523, KB5053598, KB5051987, KB5050009
+4 earlier KB5048667, KB5046617, KB5043080, KB5044284
Replaced by
KB5060842
VersionBuildChannel
2025 26100.4061 General availability

Security

43 vulnerabilities fixed
5 exploited 5 critical 38 important
VulnerabilitySeverityCVSS
CVE-2025-30400 Exploited
Microsoft DWM Core Library Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32701 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32706 Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-32709 Exploited
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
 Important 7.8
CVE-2025-30397 Exploited
Scripting Engine Memory Corruption Vulnerability
 Important 7.5
CVE-2025-29966
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-29967
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2024-49128
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-32710
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-29833
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
 Critical 7.7

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 43 vulnerabilities →

Updated components

7,575 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings148
Audio52
Bluetooth49
Graphics and display44
Printing42
.NET networking38
Networking38
Security and sign-in32
Windows Update30
Storage and file systems27
File Explorer and shell26
Hyper-V and virtualization25

Verified in package: changed files confirm Audio, File Explorer, USB audio device drivers, Wi-Fi, Windows update installation, Chinese Pinyin Input Method Editor (IME), Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b), Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI), Settings.

Sources

Updated
Cited passages from Microsoft's official notes (25)
  1. 1. [Audio] Fixed: This update addresses an issue where the audio form your microphone might mute unexpectedly. support.microsoft.com
  2. 2. [Eye controller] Fixed: The eye controller app doesn’t launch. support.microsoft.com
  3. 3. Fixed: After performing a search, it might repeat unexpectedly. support.microsoft.com
  4. 4. Fixed: The date and time properties of a file might update after you copy it. support.microsoft.com
  5. 5. Fixed: Icons on the details pane might not update as you expect when you change a theme. support.microsoft.com
  6. 6. Fixed: The search box might lose input focus as you type. support.microsoft.com
  7. 7. [Memory leak] Fixed: Leaks occur when predictive input ideas show. support.microsoft.com
  8. 8. Fixed: The mouse cursor might disappear. This occurs when you hover over text fields in certain applications. support.microsoft.com
  9. 9. Fixed: If you turn on pointer trails, the mouse cursor becomes transparent, and a black box appears behind it. support.microsoft.com
  10. 10. Fixed: The mouse cursor might stutter when it moves across the screen. This occurs even when the system is not using a lot of resources. support.microsoft.com
  11. 11. [Pinyin Input Method Editor (IME)] Fixed: When you switch app windows, the IME language might change from Chinese to English. support.microsoft.com
  12. 12. [Snipping Tool] Fixed: Snipping Tool screenshots might be distorted. This occurs when you use two or more monitors that have different display scaling. support.microsoft.com
  13. 13. [Task Manager] Fixed: After closing the app, it remains open longer than expected. support.microsoft.com
  14. 14. [USB audio device drivers] Fixed: The code 10 error message, “This device cannot start” appears. This occurs when you connect to certain external audio management devices. support.microsoft.com
  15. 15. [Wi-Fi] Fixed: The Windows Security dialog might stop responding when you sign into certain Wi-Fi networks. support.microsoft.com
  16. 16. [Windows Hello] Fixed: This update addresses an edge case issue where Windows Hello doesn’t work on devices with System Guard Secure Launch or Dynamic Root of Trust for Measurement (DRTM) features enabled support.microsoft.com
  17. 17. [Windows update installation] Fixed: Cumulative updates might not install. The error code is 0x800736b3. support.microsoft.com
  18. 18. [Chinese Pinyin Input Method Editor (IME)] With this update, Bing will no longer provide automatic suggestions in the search box for search engines such as Baidu. support.microsoft.com
  19. 19. This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  20. 20. This update applies improvements to SBAT for the detection of Linux systems. support.microsoft.com
  21. 21. After this update is installed, Active Directory domain controllers will no longer allow anonymous clients to invoke some RPC requests through the Netlogon RPC server. support.microsoft.com
  22. 22. [Fonts] New! This update includes Simsun-ExtG, a new simplified Chinese font featuring the Biangbiang noodles character. support.microsoft.com
  23. 23. [Settings] New! Change time zones in Settings > Time & Language > Date & Time. Admins You don’t have to be an admin to make this change. support.microsoft.com
  24. 24. Active Directory domain controllers (DC) running on Windows Server 2025 and also running the schema master Flexible Single Master Operation (FSMO) role, will allow duplicate entries in attributes of schema objects. support.microsoft.com
  25. 25. To address this, try enabling the Printing-PrintToPDFServices-Feature using one of the following options: support.microsoft.com
Checked automatically: 8 of 8 checks passed, 25 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake