# KB5055528: April 2025 cumulative update for Windows 11 22H2 KB5055528, released April 8, 2025, fixes 67 CVEs across 4 products. One of them is being exploited (CVE-2025-29824); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/microsoft/kb5055528 - Platform: Microsoft - Released: Apr 8, 2025 - Priority: Patch now (Closes CVE-2025-29824, exploited (CISA KEV, ransomware)) - CVEs: 67, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://support.microsoft.com/help/5055528 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows 11 Version 22H2 for ARM64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-22h2-for-arm64-based-systems.md) | | | | [Windows 11 Version 22H2 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-22h2-for-x64-based-systems.md) | | | | [Windows 11 Version 23H2 for ARM64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-23h2-for-arm64-based-systems.md) | | | | [Windows 11 Version 23H2 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-23h2-for-x64-based-systems.md) | | | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-29824](https://patchblox.com/security/data/cve/CVE-2025-29824.md) | Patch now | Windows Common Log File System Driver | 7.8 | 0.1925 | CISA KEV, Ransomware | | [CVE-2025-26670](https://patchblox.com/security/data/cve/CVE-2025-26670.md) | Urgent | Windows LDAP - Lightweight Directory Access Protocol | 8.1 | 0.1105 | More likely | | [CVE-2025-29809](https://patchblox.com/security/data/cve/CVE-2025-29809.md) | Urgent | Windows Kerberos | 7.1 | 0.0426 | More likely | | [CVE-2025-26663](https://patchblox.com/security/data/cve/CVE-2025-26663.md) | Urgent | Windows LDAP - Lightweight Directory Access Protocol | 8.1 | 0.0179 | More likely | | [CVE-2025-27491](https://patchblox.com/security/data/cve/CVE-2025-27491.md) | Urgent | Windows Hyper-V | 7.1 | 0.0143 | | | [CVE-2025-26686](https://patchblox.com/security/data/cve/CVE-2025-26686.md) | Urgent | Windows TCP/IP | 7.5 | 0.0142 | | | [CVE-2025-27727](https://patchblox.com/security/data/cve/CVE-2025-27727.md) | Urgent | Windows Installer | 7.8 | 0.0104 | More likely | | [CVE-2025-29812](https://patchblox.com/security/data/cve/CVE-2025-29812.md) | Urgent | Windows Kernel Memory | 7.8 | 0.0093 | More likely | | [CVE-2025-21204](https://patchblox.com/security/data/cve/CVE-2025-21204.md) | High | Windows Update Stack | 7.8 | 0.0713 | | | [CVE-2025-26673](https://patchblox.com/security/data/cve/CVE-2025-26673.md) | High | Windows LDAP - Lightweight Directory Access Protocol | 7.5 | 0.0273 | | | [CVE-2025-29810](https://patchblox.com/security/data/cve/CVE-2025-29810.md) | High | Active Directory Domain Services | 7.5 | 0.0262 | | | [CVE-2025-27469](https://patchblox.com/security/data/cve/CVE-2025-27469.md) | High | Windows LDAP - Lightweight Directory Access Protocol | 7.5 | 0.0257 | | | [CVE-2025-26641](https://patchblox.com/security/data/cve/CVE-2025-26641.md) | High | Windows Cryptographic Services | 7.5 | 0.0227 | | | [CVE-2025-27473](https://patchblox.com/security/data/cve/CVE-2025-27473.md) | High | Windows HTTP.sys | 7.5 | 0.0227 | | | [CVE-2025-27477](https://patchblox.com/security/data/cve/CVE-2025-27477.md) | High | Windows Telephony Service | 8.8 | 0.0161 | | | [CVE-2025-26669](https://patchblox.com/security/data/cve/CVE-2025-26669.md) | High | Windows Routing and Remote Access Service (RRAS) | 8.8 | 0.0153 | | | [CVE-2025-27487](https://patchblox.com/security/data/cve/CVE-2025-27487.md) | High | Remote Desktop Client | 8.0 | 0.0152 | | | [CVE-2025-21205](https://patchblox.com/security/data/cve/CVE-2025-21205.md) | High | Windows Telephony Service | 8.8 | 0.0139 | | | [CVE-2025-21221](https://patchblox.com/security/data/cve/CVE-2025-21221.md) | High | Windows Telephony Service | 8.8 | 0.0139 | | | [CVE-2025-21222](https://patchblox.com/security/data/cve/CVE-2025-21222.md) | High | Windows Telephony Service | 8.8 | 0.0139 | | | [CVE-2025-27481](https://patchblox.com/security/data/cve/CVE-2025-27481.md) | High | Windows Telephony Service | 8.8 | 0.0127 | | | [CVE-2025-26668](https://patchblox.com/security/data/cve/CVE-2025-26668.md) | High | Windows Routing and Remote Access Service (RRAS) | 7.5 | 0.0126 | | | [CVE-2025-26687](https://patchblox.com/security/data/cve/CVE-2025-26687.md) | High | Windows Win32K - GRFX | 7.5 | 0.0116 | | | [CVE-2025-27729](https://patchblox.com/security/data/cve/CVE-2025-27729.md) | High | Windows Shell | 7.8 | 0.0083 | | | [CVE-2025-27484](https://patchblox.com/security/data/cve/CVE-2025-27484.md) | High | Windows Universal Plug and Play (UPnP) Device Host | 7.5 | 0.0083 | | | [CVE-2025-27737](https://patchblox.com/security/data/cve/CVE-2025-27737.md) | High | Windows Security Zone Mapping | 8.6 | 0.0078 | | | [CVE-2025-26666](https://patchblox.com/security/data/cve/CVE-2025-26666.md) | High | Windows Media | 7.8 | 0.0064 | | | [CVE-2025-26674](https://patchblox.com/security/data/cve/CVE-2025-26674.md) | High | Windows Media | 7.8 | 0.0064 | | | [CVE-2025-27467](https://patchblox.com/security/data/cve/CVE-2025-27467.md) | High | Windows Digital Media | 7.8 | 0.0064 | | | [CVE-2025-27476](https://patchblox.com/security/data/cve/CVE-2025-27476.md) | High | Windows Digital Media | 7.8 | 0.0064 | | | [CVE-2025-27730](https://patchblox.com/security/data/cve/CVE-2025-27730.md) | High | Windows Digital Media | 7.8 | 0.0064 | | | [CVE-2025-27731](https://patchblox.com/security/data/cve/CVE-2025-27731.md) | High | OpenSSH for Windows | 7.8 | 0.0064 | | | [CVE-2025-27739](https://patchblox.com/security/data/cve/CVE-2025-27739.md) | High | Windows Kernel | 7.8 | 0.0064 | | | [CVE-2025-24058](https://patchblox.com/security/data/cve/CVE-2025-24058.md) | High | Windows DWM Core Library | 7.8 | 0.0061 | | | [CVE-2025-24060](https://patchblox.com/security/data/cve/CVE-2025-24060.md) | High | Windows DWM Core Library | 7.8 | 0.0061 | | | [CVE-2025-24062](https://patchblox.com/security/data/cve/CVE-2025-24062.md) | High | Windows DWM Core Library | 7.8 | 0.0061 | | | [CVE-2025-24073](https://patchblox.com/security/data/cve/CVE-2025-24073.md) | High | Windows DWM Core Library | 7.8 | 0.0061 | | | [CVE-2025-24074](https://patchblox.com/security/data/cve/CVE-2025-24074.md) | High | Windows DWM Core Library | 7.8 | 0.0061 | | | [CVE-2025-27490](https://patchblox.com/security/data/cve/CVE-2025-27490.md) | High | Windows Bluetooth Service | 7.8 | 0.0061 | | | [CVE-2025-29811](https://patchblox.com/security/data/cve/CVE-2025-29811.md) | High | Windows Mobile Broadband | 7.8 | 0.0060 | | | [CVE-2025-26675](https://patchblox.com/security/data/cve/CVE-2025-26675.md) | High | Windows Subsystem for Linux | 7.8 | 0.0060 | | | [CVE-2025-26679](https://patchblox.com/security/data/cve/CVE-2025-26679.md) | High | RPC Endpoint Mapper Service | 7.8 | 0.0059 | | | [CVE-2025-26688](https://patchblox.com/security/data/cve/CVE-2025-26688.md) | High | Microsoft Virtual Hard Drive | 7.8 | 0.0058 | | | [CVE-2025-26639](https://patchblox.com/security/data/cve/CVE-2025-26639.md) | High | Windows USB Print Driver | 7.8 | 0.0057 | | | [CVE-2025-26678](https://patchblox.com/security/data/cve/CVE-2025-26678.md) | High | Windows Defender Application Control (WDAC) | 8.4 | 0.0054 | | | [CVE-2025-26648](https://patchblox.com/security/data/cve/CVE-2025-26648.md) | High | Windows Kernel | 7.8 | 0.0048 | | | [CVE-2025-26640](https://patchblox.com/security/data/cve/CVE-2025-26640.md) | High | Windows Digital Media | 7.0 | 0.0048 | | | [CVE-2025-27478](https://patchblox.com/security/data/cve/CVE-2025-27478.md) | High | Windows Local Security Authority (LSA) | 7.0 | 0.0046 | | | [CVE-2025-26649](https://patchblox.com/security/data/cve/CVE-2025-26649.md) | High | Windows Secure Channel | 7.0 | 0.0039 | | | [CVE-2025-27475](https://patchblox.com/security/data/cve/CVE-2025-27475.md) | High | Windows Update Stack | 7.0 | 0.0037 | | | [CVE-2025-27492](https://patchblox.com/security/data/cve/CVE-2025-27492.md) | High | Windows Secure Channel | 7.0 | 0.0035 | | | [CVE-2025-27732](https://patchblox.com/security/data/cve/CVE-2025-27732.md) | High | Windows Win32K - GRFX | 7.0 | 0.0035 | | | [CVE-2025-26665](https://patchblox.com/security/data/cve/CVE-2025-26665.md) | High | Windows upnphost.dll | 7.0 | 0.0034 | | | [CVE-2025-21191](https://patchblox.com/security/data/cve/CVE-2025-21191.md) | High | Windows Local Security Authority (LSA) | 7.0 | 0.0032 | | | [CVE-2025-27738](https://patchblox.com/security/data/cve/CVE-2025-27738.md) | Routine | Windows Resilient File System (ReFS) | 6.5 | 0.0357 | | | [CVE-2025-21197](https://patchblox.com/security/data/cve/CVE-2025-21197.md) | Routine | Windows NTFS | 6.5 | 0.0332 | | | [CVE-2025-26651](https://patchblox.com/security/data/cve/CVE-2025-26651.md) | Routine | Windows Local Session Manager (LSM) | 6.5 | 0.0261 | | | [CVE-2025-26672](https://patchblox.com/security/data/cve/CVE-2025-26672.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0185 | | | [CVE-2024-21302](https://patchblox.com/security/data/cve/CVE-2024-21302.md) | Routine | Windows Secure Kernel Mode | 6.7 | 0.0157 | Disclosed | | [CVE-2025-26635](https://patchblox.com/security/data/cve/CVE-2025-26635.md) | Routine | Windows Hello | 6.5 | 0.0153 | | | [CVE-2025-27471](https://patchblox.com/security/data/cve/CVE-2025-27471.md) | Routine | Microsoft Streaming Service | 5.9 | 0.0132 | | | [CVE-2025-27736](https://patchblox.com/security/data/cve/CVE-2025-27736.md) | Routine | Windows Power Dependency Coordinator | 5.5 | 0.0094 | | | [CVE-2025-27742](https://patchblox.com/security/data/cve/CVE-2025-27742.md) | Routine | Windows NTFS | 5.5 | 0.0088 | | | [CVE-2025-26637](https://patchblox.com/security/data/cve/CVE-2025-26637.md) | Routine | Windows BitLocker | 6.8 | 0.0086 | | | [CVE-2025-26681](https://patchblox.com/security/data/cve/CVE-2025-26681.md) | Routine | Windows Win32K - GRFX | 6.7 | 0.0058 | | | [CVE-2025-26644](https://patchblox.com/security/data/cve/CVE-2025-26644.md) | Routine | Windows Hello | 5.1 | 0.0056 | | | [CVE-2025-27735](https://patchblox.com/security/data/cve/CVE-2025-27735.md) | Routine | Windows Virtualization-Based Security (VBS) Enclave | 6.0 | 0.0041 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo