Windows

Microsoft Acknowledges UI Issues In Windows 11 25H2 and 24H2 After Latest Update

Microsoft has confirmed user interface glitches in Windows 11 versions 24H2 and 25H2 following monthly cumulative updates released on or after July 2025, such as KB5062553 and KB5065789.

These problems disrupt XAML-dependent modern apps, including File Explorer, the Start menu, System Settings, Taskbar, and Windows Search.

The issues surface primarily in enterprise or managed environments, like virtual desktop infrastructure (VDI) setups, and rarely affect personal consumer devices.

The glitches occur when updates are installed before the first user logon on a persisted OS or during any logon on a non-persistent system, where app packages must reprovision each session.

XAML components fail to register promptly, leading to core shell elements breaking.

Affected users report black screens on Explorer.exe startup, unopenable Start menus with critical errors from StartMenuExperienceHost.exe, Taskbar rendering failures, and shellhost.exe crashes.

Impact On Enterprise Shell and XAML Apps

In enterprise scenarios, specific packages like Microsoft Windows.Client.CBS_cw5n1h2txyewy, Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe, and Microsoft Windows.Client.Core_cw5n1h2txyewy underpins these failures.

Explorer.exe often leads to black screens or crashes, halting desktop rendering. The Start menu displays error dialogs, while Taskbar elements vanish entirely.

XAML-dependent apps compound the chaos: Consent.exe (User Account Control UI) crashes on initialization, System Settings silently fails to launch, and other XAML island views like those in third-party apps refuse to load.

IT teams in VDI environments, such as Azure Virtual Desktop, face repeated disruptions across sessions, as packages do not persist between logons.

Microsoft notes these stem from timing mismatches in XAML package registration post-update.

Workarounds and Path To Resolution

IT administrators can manually register the missing packages via PowerShell in the user session, then restart SiHost.exe to refresh Immersive Shell components. Commands include:

Add-AppxPackage -Register -Path 'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\appxmanifest.xml' -DisableDevelopmentMode

Repeat for the UI.Xaml.CBS and Client.Core paths.

For non-persistent VDI, deploy a logon batch script wrapper that executes these synchronously before Explorer launches, using powershell.exe -ExecutionPolicy Bypass to bypass restrictions.

Microsoft is developing a permanent fix and promises updates via the support articles: KB5062553 and KB5065789.

Enterprise managers should monitor these for patches, test in staging environments, and apply workarounds to minimize downtime.

This incident underscores the risks of update sequencing in virtualized deployments.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies..

Share
Published by
Varshini
Tags: windows

Recent Posts

Burp Suite Supercharges Its Scanning Capabilities With React2Shell Vulnerability Detection

PortSwigger has leveled up Burp Suite's scanning arsenal with the latest Active Scan++ extension, version…

4 months ago

Malicious MCP Servers Enable New Prompt Injection Attack To Drain Resources

Unit 42 researchers at Palo Alto Networks exposed serious flaws in the Model Context Protocol…

4 months ago

Law Enforcement Detains Hackers Equipped With Specialized Flipper Hacking Tools

Polish police have arrested three Ukrainian men traveling through Europe and seized a cache of…

4 months ago

Google Unveils 10 New Gemini-Powered AI Features For Chrome

Google has launched its most significant Chrome update ever, embedding Gemini AI across the browser…

4 months ago

CISA Alerts On Actively Exploited Buffer Overflow Flaw In D-Link Routers

Attackers exploit this vulnerability through the router's web interface components, specifically "cgibin" and "hnap_main," by…

4 months ago

Over 500 Apache Tika Toolkit Instances Exposed To Critical XXE Vulnerability

Security researchers have uncovered a severe flaw in Apache Tika, a popular open-source toolkit for…

4 months ago