Microsoft · ServicingStack update · April 11, 2023

KB5025239: April 2023 cumulative update for Windows 11 22H2

KB5025239, released April 11, 2023, fixes 59 CVEs across 2 products. 2 of them are being exploited (CVE-2023-28252); 2 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now2 on CISA KEVKnown ransomware use1 publicly disclosedUnsupported product
CVEs closed
59
5 rated Critical
Exploited
2
CVE-2023-28252
Exploitation more likely
8
Microsoft's assessment
Highest EPSS
0.9541
99th percentile

Priority of the 59 CVEs

Patch now 2 Urgent 10 High 34 Routine 13

Applies to

ProductBuild after install
Windows 11 Version 22H2 for ARM64-based Systems22621.1555
Windows 11 Version 22H2 for x64-based Systems22621.1555

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2023-28252 Windows Common Log File System DriverElevation of Privilege7.8 0.4889 KEVRansomwareExploited
Patch now CVE-2023-28229 Windows CNG Key Isolation ServiceElevation of Privilege7.0 0.0167 KEVExploited
Urgent CVE-2023-21554 Windows Message QueuingRemote Code Execution9.8 0.9541 More likely
Urgent CVE-2023-28219 Windows Layer 2 Tunneling ProtocolRemote Code Execution8.1 0.1498 More likely
Urgent CVE-2023-28220 Windows Layer 2 Tunneling ProtocolRemote Code Execution8.1 0.1498 More likely
Urgent CVE-2023-28218 Windows Ancillary Function Driver for WinSockElevation of Privilege7.0 0.1240 More likely
Urgent CVE-2023-28274 Windows Win32KElevation of Privilege7.8 0.0683 More likely
Urgent CVE-2023-28227 Microsoft Bluetooth DriverRemote Code Execution7.5 0.0659 More likely
Urgent CVE-2023-28266 Windows Common Log File System DriverInformation Disclosure5.5 0.0436 More likely
Urgent CVE-2023-24912 Microsoft Graphics ComponentElevation of Privilege7.8 0.0357 More likely
Urgent CVE-2023-28250 Windows PGMRemote Code Execution9.8 0.0203 Exploitation Less Likely
Urgent CVE-2023-28232 Windows Point-to-Point Tunneling ProtocolRemote Code Execution7.5 0.0091 Exploitation Less Likely
High CVE-2023-28302 Windows Active DirectoryDenial of Service7.5 0.9257 Exploitation Less Likely
High CVE-2023-21769 Windows Message QueuingDenial of Service7.5 0.8867 Exploitation Less Likely
High CVE-2023-28293 Windows KernelElevation of Privilege7.8 0.0287 Exploitation Less Likely
High CVE-2023-24931 Windows Secure ChannelDenial of Service7.5 0.0203 Exploitation Less Likely
High CVE-2023-28241 Windows Secure Socket Tunneling Protocol (SSTP)Denial of Service7.5 0.0199 Exploitation Less Likely
High CVE-2023-28217 Windows Network Address Translation (NAT)Denial of Service7.5 0.0194 Exploitation Less Likely
High CVE-2023-28233 Windows Secure ChannelDenial of Service7.5 0.0173 Exploitation Less Likely
High CVE-2023-28234 Windows Transport Security Layer (TLS)Denial of Service7.5 0.0173 Exploitation Less Likely
High CVE-2023-21727 Windows RPC APIRemote Code Execution8.8 0.0164 Exploitation Less Likely
High CVE-2023-24884 Microsoft Printer DriversRemote Code Execution8.8 0.0164 Exploitation Less Likely
High CVE-2023-24885 Microsoft Printer DriversRemote Code Execution8.8 0.0164 Exploitation Less Likely
High CVE-2023-24886 Microsoft Printer DriversRemote Code Execution8.8 0.0164 Exploitation Less Likely
High CVE-2023-24887 Microsoft Printer DriversRemote Code Execution8.8 0.0164 Exploitation Less Likely
Showing 1 to 25 of 59 1Next

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.