KB5055612: Updates to the Windows Kernel Vulnerable Driver Blocklist

April 22, 2025—KB5055612 (OS Build 19045.5796) Preview

Summary
This non-security update includes quality improvements. Below is a summary of the key issues that this update addresses when you install this update. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.

Highlights

• [Internal Windows OS] This update contains miscellaneous security improvements to internal Windows OS functionality.

Improvements

• [Graphics] Fix: The check for GPU paravirtualization was case-sensitive in Windows Subsystem for Linux 2 (WSL2). This issue might potentially cause GPU paravirtualization support to fail.
  - [OS Security] Updates to the Windows Kernel Vulnerable Driver Blocklist (DriverSiPolicy.p7b). Additions have been made to blocklist drivers with security vulnerabilities that have been used in Bring Your Own Vulnerable Driver (BYOVD) attacks.
• [System Guard Runtime Monitor Broker service (Known issue)] Fixed: The Windows Event Viewer might display an error related to SgrmBroker.exe, on devices that have installed Windows updates released January 14, 2025, or later. This error can be found under Windows Logs > System as Event 7023, with text similar to ‘The System Guard Runtime Monitor Broker service terminated with the following error: %%3489660935’.

Known issues in this update
Citrix
Symptoms
Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. The 2411 version of this application was released in December 2024.

Affected devices might initially download and apply the January 2025 Windows security update correctly, such as via the Windows Update page in Settings. However, when restarting the device to complete the update installation, an error message with text similar to “Something didn’t go as planned. No need to worry – undoing changes” appears. The device will then revert to the Windows updates previously present on the device.

This issue likely affects a limited number of organizations as version 2411 of the SRA application is a new version. Home users are not expected to be affected by this issue.

Workaround
Citrix has documented this issue, including a workaround, which can be performed prior to installing the January 2025 Windows security update. For details, see Citrix’s documentation.

Microsoft is working with Citrix to address this issue and will update this documentation once a resolution is available. ​​​​​​​