KB5089548

Microsoft released cumulative security update KB5089548 (Build 28000.2113) for Windows 11, version 26H1 as part of the May 2026 Patch Tuesday for PCs with ARM processors. Windows 11, version 26H1 received security update KB5089548 for May 2026 for PCs with ARM64 architecture processors (Snapdragon). Additionally, the update is available for devices with x64 architecture processors (x86-64, Intel and AMD).

• Expanding Narrator capabilities. Added detailed image descriptions on Copilot+ PCs and collaboration with Copilot on all Windows 11 devices.
• Managing Smart App Control without reinstalling the system. You can now turn Smart App Control on and off without a clean OS reinstall.
• Changing Microsoft 365 Family plan in Settings. Microsoft 365 Family subscribers can now change their plan directly in Settings > Accounts.
• New File Explorer features. Added View anyway button for files from the internet, voice input support (Win + H) when renaming, and permission sorting by Subject column.
• Support for monitors with refresh rates above 1000 Hz. Monitors can now report refresh rates above 1000 Hz, improved reliability of HDR and automatic screen rotation after exiting sleep mode.
• Fixes in RDP and NTDS.dit. Fixed issues with NTDS.dit database when using ntdsutil.exe with 8 KB pages and with the RDP security warning dialog when using multiple monitors with different scaling.
• Improved SSDP reliability. Improved reliability of Simple Service Discovery Protocol (SSDP) notifications on the network to prevent the service from becoming unresponsive.
• Gaming improvements. Improved compatibility of some games that use embedded web content, and reduced the impact of JavaScript errors on in-game features.

The official description of update KB5089548 currently reports no critical known issues. However, it is recommended to monitor updates on the Microsoft support website, as typical Patch Tuesday incidents with ARM64 and x64 driver compatibility may occur on specific configurations.

Automatic installation through Windows Update works only on devices with ARM processors. The update includes all fixes and changes from preview update KB5083806 (Build 28000.1896) for Windows 11, version 26H1.

To install, go to Settings > Windows Update and click Check for updates. A computer restart is required to complete the installation.

To update Windows 11 Build 28000 to build 28000.2113, you can also download update KB5089548 and install it manually using the links above.

This release does not include non-security related interface changes — this update is cumulative and primarily fixes vulnerabilities and accumulated bugs.

How the new features work:

Expanding Narrator capabilities. Narrator on Copilot+ PCs uses local AI models to generate detailed image descriptions without sending data to the cloud. On all Windows 11 devices, when recognizing UI elements or buttons, Narrator can request a contextual hint from Copilot (via a secure API) that analyzes the current window and nearby controls.

Managing Smart App Control without reinstalling the system. Smart App Control (SAC) is a kernel‑based mechanism evaluating executables by Microsoft's reputation signature. Previously, changing SAC mode required a clean install because of one‑time evaluation module initialization during OOBE. Now SAC settings are stored as dynamic registry parameters and code integrity policies, allowing toggling between "Evaluation" and "Off" without reinstalling.

Changing Microsoft 365 Family plan in Settings. The option in Settings > Accounts calls the Microsoft Store subscription management API, which communicates with the MSA (Microsoft Account) service and the OLC (Online Licensing Contractor) license provider. When changing the plan, a request updates the entitlement token in the local cache of the ClipSVC service, after which the system notifies Office 365 applications of the rights change via a LicenseChanged event.

New File Explorer features. The View anyway button bypasses the Alternate Data Stream marker Zone.Identifier by setting a registry flag at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer for unlocking. Voice input (Win + H) activates the speech recognition server via the ISpRecognizer API, which sends text to the rename element. Sorting by the Subject column works using the System.Subject property from the search indexer.

Support for monitors with refresh rates above 1000 Hz. The graphics driver reads extended EDID blocks with refresh rates up to 2000 Hz via DDC/CI (Display Data Channel Command Interface) and stores them in the DirectX mode pool (DXGKRNL). Atomic HDR switching at these frequencies uses D3DKMTSetHDRMetadata transactions. Automatic screen rotation based on the accelerometer sensor (HID Sensor) is now delayed until 150 ms stabilization after exiting sleep.

Fixes in RDP and NTDS.dit. NTDS.dit restoration via ntdsutil.exe with 8 KB pages is fixed by aligning the ESENT page size to the storage physical sector in JetSetSystemParameter(JET_PAGE_SIZE) semantic checks. RDP with multiple monitors of different scalings (Mixed DPI) now correctly displays the security warning dialog by recalculating window coordinates inside the rdpwsx.dll session.

Improved SSDP reliability. SSDP (Simple Service Discovery Protocol) works via UDP multicast to address 239.255.255.250:1900. The upnphost service now regulates NOTIFY message intervals using exponential backoff and uses a shadow copy of the network adapter list to avoid deadlocks during dynamic route changes.

Gaming improvements. Games with embedded WebView2 now handle JavaScript errors through inter‑process isolation: the main game thread receives only a warning, not a crash. The CoreWebView2.AddScriptToExecuteOnDocumentCreated mechanism intercepts non‑fatal exceptions and forwards them to the game log without blocking rendering.

The last 10 Windows updates: