Cyber Security News

Microsoft Confirms Windows 11 25H2 UI Features Broken also Along With 24H2 Following Update

Microsoft has acknowledged a significant issue affecting Windows 11 versions 24H2 and 25H2.

Where critical user interface components break following the installation of monthly cumulative updates released on or after July 2025.

The problem impacts XAML-dependent modern applications, including core Windows components such as File Explorer, the Start menu, System Settings, Taskbar, and Windows Search.

Users in affected environments may experience a range of disruptive symptoms, from applications failing to launch to complete desktop rendering failures.

Overview of the Windows 11 UI Breakdown Issue

Microsoft confirmed that this issue primarily affects enterprise and managed environments.

Stating it is “very unlikely to occur on personal devices used by individuals.” The bug manifests in specific provisioning scenarios.

Particularly when Windows updates are installed before the first user logon to a persisted operating system installation.

In non-persistent environments such as virtual desktop infrastructure (VDI) deployments.

In VDI scenarios, application packages must be installed during each logon session, making these environments especially vulnerable to the timing-related registration failure.

Affected users may encounter several critical failures. Explorer.exe crashes can cause users to log on to a black screen with no visible taskbar.

The Start menu may fail to open entirely, often displaying a critical error message.

System Settings silently fails to launch, and other XAML-dependent applications crash during startup when attempting to initialize XAML views.

The root cause is that XAML dependency packages fail to register in time after a Windows update is installed.

The affected packages include Microsoft Windows. Client.CBS, Microsoft.UI.Xaml.CBS, and Microsoft Windows.Client.Core.

While Microsoft works on a permanent resolution, IT administrators can implement manual workarounds.

For persistent installations, administrators should register the missing packages using PowerShell’s Add-AppxPackage command and restart SiHost to allow Immersive Shell components to initialize correctly.

For non-persistent VDI environments, Microsoft recommends implementing a logon script approach using a batch file wrapper.

This ensures the registration script runs synchronously, effectively blocking Explorer from launching prematurely until required packages are fully provisioned.

Microsoft stated that they are actively developing a resolution and will provide updates as more information becomes available.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Abi naya

Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

1 day ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

1 day ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

1 day ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

2 days ago