KB5095051

Microsoft has released cumulative security update KB5095051 (Build 28000.2269) for Windows 11, version 26H1 as part of Patch Tuesday (June 2026) for ARM-based PCs.

• Shared audio listening. The ability to broadcast sound to two pairs of Bluetooth LE Audio headphones simultaneously has appeared.
• Xbox Mode. A simplified full-screen interface for laptops, desktop PCs and tablets has been added, activated by the Windows + F11 key combination.
• Archive support in File Explorer. Built-in support for uu, cpio, xar and NuGet (nupkg) formats has been implemented.
• Haptic feedback for pens. When aligning objects and snapping windows, a tactile response now triggers on compatible Surface Slim Pen 2, ASUS Pen 3.0 and MSI Pen 2 pens.
• Updated voice typing. The design of the voice typing interface on the touch keyboard has been changed, and the Arabic 101 Legacy layout has been added.
• Agent tracking on the Taskbar. A new mechanism has been introduced, first utilized by Researcher in Microsoft 365 Copilot.
• Driver security policy tightening. Trust for cross-signed drivers is disabled by default. Only drivers certified under the Windows Hardware Compatibility Program and those included in the trusted legacy driver list are allowed.
• Protected batch file mode. The ability to lock batch files while in use has appeared via the LockBatchFilesWhenInUse registry parameter.
• Increased FAT32 limit. The formatting limit for FAT32 via the command line has been increased to 2 TB.
• Startup app launch acceleration. The launch of applications from autostart after system boot has been optimized.
• Windows Hello improvements. Facial recognition reliability has been improved, and fingerprint data preservation during system updates has been ensured.
• Delivery Optimization optimization. RAM usage by the corresponding service has been improved.
• Secure Boot certificates. High-confidence targeting data has been added to expand the range of devices automatically receiving new certificates, along with the LimitSecureBootRequiredServiceData group policy to restrict the volume of transmitted service data.
• BitLocker reliability. The stability of drive encryption testing has been improved, ensuring all necessary files are present for the USB BIOS logo test.

Installation via Windows Update: Go to Settings > Windows Update and click Check for updates. A computer restart is required to complete the installation.

To update Windows 11 Build 28000 to build 28000.2269, you can also download the KB5095051 update and install it manually using the links above.

A computer restart is required to complete the installation. After the update, the Windows 11 Build 28000 build number will change to 28000.2269.

How the new features work:

Shared audio listening: The technology is based on the Auracast profile of the Bluetooth LE Audio standard. The system acts as a broadcast source, encapsulating the audio stream into isochronous packets. The host controller forms a Broadcast Isochronous Stream (BIS), to which two pairs of headphones synchronously subscribe, using the same Broadcast Code for decryption, bypassing the classic point-to-point A2DP connection.

Xbox Mode: This is a shell overlay activated by the Windows + F11 hotkey, which switches the window manager to a full-screen mode with DirectX rendering priority for the gamepad. The interface is rebuilt for XInput gamepad navigation, hiding the classic desktop and replacing it with a tiled or carousel shell optimized for high DPI and a 10-foot UX.

Archive support in File Explorer: The functionality is implemented through the IExplorerCommand interface extension and shell namespace handlers. Parsing of the uu, cpio, xar, and nupkg formats is carried out via integrated libarchive libraries and specialized NuGet codec filters, which allow the file manager to recursively traverse the container's contents as a virtual folder without third-party unpackers.

Haptic feedback for pens: It uses the Windows Pen API driver in conjunction with a sensory processor, which, upon detecting a magnetic attraction (snapping) event via UI Automation, calls the PlayInkFeedback method. On compatible pens (Surface Slim Pen 2, ASUS Pen 3.0, MSI Pen 2), a command is sent to a linear resonant actuator to reproduce a vibration pattern simulating mechanical fixation.

Updated voice typing: The architecture is based on a redesigned touch keyboard canvas, where the TextInputHost host window redraws the dictation panel on top of the input area. The Arabic 101 Legacy layout has been added with modified virtual key scan codes, adjusting the character translation table for correct diacritic processing by the speech recognition engine during offline dictation.

Agent tracking on the Taskbar: A new observed object has been introduced in the Taskbar Shell Experience Host, implementing the ITrayNotify interface and monitoring state via Event Tracing for Windows (ETW). The first consumer is the Researcher in Microsoft 365 Copilot, which registers its COM object to receive activity signals (active window, hints) through a cross-process bridge.

Driver security policy tightening: The code integrity verification mechanism at the kernel loading stage now requires a WHCP signature with a WHQL certificate, blocking cross-signing. The boot manager analyzes the EKU attribute of the certificate for inclusion in the Trusted Legacy Driver List; in its absence, the MmLoadSystemImage call fails with the STATUS_INVALID_IMAGE_HASH error.

Protected batch file mode: Implemented via the LockBatchFilesWhenInUse registry parameter, which instructs the command-line interpreter to monopolize the file stream by calling the Win32 API CreateFileW with the FILE_SHARE_READ flag and write lock. This prevents the running script from being modified or deleted by other processes during execution.

Increased FAT32 limit: The limit in the format.com command-line utility has been changed, removing the artificial 32 GB restriction imposed solely by the graphical shell. Now, when formatting via the console, the FAT32 structure correctly calculates cluster space up to 2 TB, adhering to the specification of the maximum number of clusters supported by the fastfat.sys driver.

Startup app launch acceleration: The operation of the Session Manager and the appinfo service has been optimized; they now use a priority queue based on a preemption algorithm. The process asynchronously groups applications by logon-path criticality, launching delayed tasks with low I/O priority through the thread scheduler without blocking the Explorer message queue.

Windows Hello improvements: The machine learning model for IR cameras has been improved in the biometric stack with viewing angle compensation. For fingerprints, a mechanism for containerizing the biometric footprint in the configuration registry has been implemented; during OS updates, the migration engine captures the TPM-bound encryption key, ensuring seamless preservation and decryption of templates without re-enrollment.

Delivery Optimization optimization: The cache manager of the Delivery Optimization (DO) service has been rewritten; it now more aggressively uses the memory-mapped files technique for peer-to-peer update distribution, reducing the process's working set fragmentation by evicting unused blocks from active memory into the Windows Memory Manager's standby list.

Secure Boot certificates: High-confidence targeting data has been added to the payload of the Secure Boot Forbidden Signature Database (DBX) and Signature Database (DB). The LimitSecureBootRequiredServiceData group policy controls the attribute vector, limiting the transmission of UEFI telemetry related to code integrity checks to ensure device anonymity.

BitLocker reliability: The volume encryption testing infrastructure integrated with the pre-boot environment has been improved. Race conditions in the fvevol.sys filter driver during iterative USB BIOS Logo Test testing have been fixed, ensuring the atomicity of copying the necessary bootloader files to the EFI system partition before the integrity check begins.

The last 10 Windows updates: