Windows 11 WinRE Input Break After KB5066835 Patch

  • Thread Author
Microsoft’s October cumulative update for Windows 11 (KB5066835) created an urgent problem for many users and IT teams by rendering the Windows Recovery Environment (WinRE) non‑interactive: after installing the update, USB keyboards and mice stopped responding inside WinRE while continuing to work normally in the full Windows session, and Microsoft acknowledged the issue and said engineers were working on a fix.

Background​

Windows ships a small, separate recovery image known as Windows Recovery Environment (WinRE). WinRE is a compact “Safe OS” (commonly packaged as winre.wim) that runs outside the primary desktop and provides critical repair tools — Startup Repair, Safe Mode, System Restore, an offline Command Prompt, and Reset this PC. Because WinRE intentionally carries a much smaller driver and service set than the full OS, it is sensitive to any change that alters its driver inventory or packaging. That design trade‑off — reliability through minimalism — is precisely why a seemingly small servicing regression can produce an outsized operational impact.
Microsoft shipped the October Patch Tuesday cumulative update on October 14, 2025 as KB5066835. Within days, community reports and vendor monitoring surfaced a consistent failure: WinRE presented its usual recovery tiles and menus, but USB input — keyboards and mice attached via USB‑A, USB‑C, or USB wireless receivers — produced no cursor movement and no keystrokes. Microsoft added the symptom to its Release Health / Known Issues dashboard and marked the issue as Confirmed, promising a remediation.

What happened — concise timeline and scope​

Timeline​

  • October 14, 2025 — Microsoft released the October cumulative update for Windows 11 as KB5066835 (OS builds referenced include 26100.6899 and 26200.6899 depending on branch).
  • October 15–17, 2025 — Multiple independent community reproductions and support threads reported that WinRE displayed correctly but did not accept USB keyboard and mouse input.
  • October 17, 2025 — Microsoft updated Release Health to list the WinRE input problem as Confirmed and stated engineers were investigating a fix.

Platforms and builds affected​

  • Windows 11, versions 24H2 and 25H2 (builds noted above).
  • Reports also implicated some Windows Server 2025 servicing branches.
The failure was reproducible across multiple OEMs and hardware types, and it produced the most severe impact on devices that lack legacy PS/2 input (many modern laptops and mini‑PCs with USB‑only input). In such devices, the absence of a PS/2 fallback means WinRE inaction effectively removes the local recovery path.

Symptoms and immediate user experience​

  • On affected systems, booting into Advanced Startup / WinRE shows the standard tiles and options (Troubleshoot → Advanced options), but the UI does not respond. There is no visible mouse cursor and keyboard presses are ignored.
  • The same USB keyboard and mouse work normally once the full Windows desktop loads, isolating the issue to the WinRE/Safe OS context rather than to hardware or desktop driver faults.
  • The inability to navigate WinRE prevents access to Safe Mode, Startup Repair, Reset this PC, System Restore, and offline Command Prompt — the very tools users and administrators rely on when the main system fails.
This situation converts routine troubleshooting into complex recovery tasks that often require external boot media, image restores, or full OS reinstalls. For non‑technical users, it can effectively remove the device’s built‑in “safety net.”

Technical anatomy — why WinRE is fragile and the likely root cause​

WinRE is not merely the desktop stripped down: it is a separate, bootable OS image with a deliberately minimal driver set. That minimalism is the environmental constraint that makes WinRE reliable in many failure scenarios — but it also makes it fragile to changes in driver packaging and Safe OS updates.
Community troubleshooting and lab reproductions quickly pointed to a Safe OS / winre.wim change or driver‑set mismatch delivered during the October servicing wave. Several practical signals support this hypothesis:
  • Replacing the active winre.wim on the recovery partition with a known‑good copy from a pre‑update image restored USB input on many test systems, indicating the failure sits inside the WinRE image rather than the desktop stack.
  • The October servicing wave included Safe OS dynamic updates and, in some distribution paths, combined Servicing Stack Update (SSU) + Latest Cumulative Update (LCU) packages. Combined packages can complicate rollback semantics and may leave Safe OS changes applied to the recovery partition even if the LCU is uninstalled. That complexity reduces the effectiveness of "just roll back the cumulative" as an immediate remedy.
Putting this together, the most plausible proximate technical cause is: a Safe OS image refresh included with KB5066835 omitted or mispackaged a USB host‑controller / xHCI driver variant that certain hardware requires in the constrained WinRE environment. The full desktop continues to work because it loads a broader driver set at runtime; WinRE does not, and so the discrepancy becomes apparent only in the recovery image.
Caveat: Microsoft has not released a line‑by‑line root‑cause post‑mortem naming a single binary or OEM driver as the definitive culprit, so external attribution beyond a Safe OS/driver mismatch remains provisional pending an official post‑fix analysis.

Concurrent regressions: the broader servicing wave impact​

KB5066835 was not limited to WinRE issues. Community reports and diagnostics after the rollout surfaced at least two distinct high‑impact regressions attributed to the same servicing wave:
  • A kernel‑mode HTTP stack (HTTP.sys) regression that broke localhost HTTP/2 connections, causing immediate resets and errors for developers and local servers. This affected IIS, IIS Express, HttpListener clients, and many development and administration workflows.
  • Installer/UI regressions and other peripheral feature losses reported in parallel threads.
The co‑existence of these regressions made the October rollup an operational headache: the running desktop often continued to function normally while critical pre‑boot and kernel network plumbing failed. This divergence complicates triage and forces administrators to weigh patching security updates against preserving recoverability.

Impact analysis — who is hurt and how badly​

Home users and consumers​

  • Devices with only USB input become vulnerable to being stuck at a non‑interactive recovery screen. Average users who rely on built‑in recovery tools may not have spare recovery drives or the experience to replace winre.wim or use image‑based recovery. This raises the risk of data loss or prolonged downtime.

Developers and local administrators​

  • The HTTP.sys regression impaired local development workflows and CI pipelines that depend on local loopback HTTP/2 endpoints. The interruption can directly affect productivity and release cycles for developers.

Enterprises and IT operations​

  • Enterprises face amplified risk because many organizations rely on WinRE for endpoint triage and in‑field repairs. The update’s combined SSU+LCU packaging in some deployments complicates rollbacks at scale, increasing mean time to repair (MTTR) and forcing fallback to external recovery media or full reimaging in some cases.
  • Helpdesk loads rise and incident-handling playbooks must adapt rapidly to include winre.wim replacement and external WinPE recovery flows. Administrators must also account for BitLocker key retrieval when using external media.

Risk to security posture​

  • Pausing or delaying deployment of a security cumulative update creates a tension: delaying an update preserves recoverability but may leave devices exposed to patched vulnerabilities. The correct organizational response is staged testing, targeted mitigation for recovery‑critical endpoints, and prioritizing rapid vendor fixes such as Known Issue Rollbacks (KIRs) or out‑of‑band hotfixes once Microsoft publishes them.

Practical mitigations and step‑by‑step guidance​

The safest immediate posture is conservative: prepare, validate, and avoid wide‑scale automatic deployment on endpoints where on‑device recovery is critical.

Immediate actions for all users (simple, high‑value)​

  • Create a bootable Windows installation / recovery USB and verify it boots the affected device. This provides an independent recovery path if WinRE is unresponsive.
  • Back up your BitLocker recovery key and ensure BitLocker keys are accessible before attempting offline repairs.
  • Delay automatic installation of KB5066835 on recovery‑critical machines until Microsoft’s remediation is confirmed.

For power users and admins (more advanced, higher risk)​

  • Inventory and preserve the current winre.wim from a known‑good machine or pre‑update image. A tested copy enables replacement if WinRE becomes unusable.
  • Replace the local winre.wim with the known‑good copy on affected machines to restore input in WinRE. This tactic has been repeatedly shown to work during reproducible community tests; it should be used only by experienced administrators with validated images.
  • Test Microsoft’s out‑of‑band hotfix or Known Issue Rollback (KIR) in a pilot ring before broader rollout. Prioritize endpoint classes that are recovery‑critical.

Quick checklist for helpdesk playbooks​

  • Verify external recovery media boots the device.
  • Confirm BitLocker key access and record key escrow procedures.
  • Train frontline technicians on winre.wim replacement and on when to escalate to full reimage.
  • Maintain documented rollback and communications steps for end users who lose access to built‑in recovery tools.

Recommended long‑term practices for update management​

The October WinRE regression is a reminder that recovery tooling must be treated as a first‑class component of update validation. Recommended changes to organizational processes:
  • Treat WinRE / Safe OS validation as part of the normal CI validation matrix for monthly updates, including testing on a matrix of USB host‑controller types and device classes.
  • Preserve and version‑control known‑good winre.wim images in your imaging pipeline to enable rapid replacement.
  • Use pilot rings targeted by recovery importance rather than only by user count; prioritize devices whose recovery failure would create the highest operational cost.
  • Maintain incident runbooks that explicitly include BitLocker key retrieval and external WinPE recovery steps so that staff can execute under pressure.

Evaluation of Microsoft’s response and systemic risks​

Microsoft’s public acknowledgment and classification of the issue as Confirmed on the Release Health dashboard is the appropriate first step; it signals active engineering attention and gives administrators a single telemetry point to monitor for updates. However, this incident also highlights structural tensions in modern servicing:
  • Combined SSU+LCU packaging and Safe OS dynamic updates can blur rollback semantics and leave recovery images changed even after an LCU uninstall — a practical barrier for rapid remediation. This packaging complexity should be weighed against the operational need for clean rollback paths in enterprise contexts.
  • The update‑validation pipeline must treat pre‑boot components (WinRE, UEFI interactions, Safe OS driver lists) with the same gravity as kernel and user‑mode components. When recovery tools are assumed sacrosanct by administrators, their accidental disruption undermines confidence in the update process.
Strengths in Microsoft’s approach include rapid advisory updates and an intent to ship a remediation quickly. The principal weakness — apparent in this incident — is test coverage and rollout mechanics for Safe OS updates across the vast hardware diversity in the Windows ecosystem. Until the vendor publishes a thorough post‑mortem, organizations should treat root‑cause narratives from community testing as useful but provisional.

What to watch for next​

  • Microsoft hotfix or Known Issue Rollback (KIR) availability and the vendor’s guidance about whether uninstalling the LCU will fully restore previous WinRE images.
  • A formal Microsoft post‑mortem describing the exact driver or packaging error that caused the regression; this will determine whether long‑term mitigations should focus on vendor driver handling, packaging changes, or process improvements.
  • Community and OEM guidance for affected device classes, especially for hardware that uses USB‑C/USB‑only input. OEMs may publish device‑specific advisories or recovery tools.
If Microsoft’s remediation includes a KIR or an out‑of‑band hotfix, administrators should validate the fix in a controlled pilot and confirm that WinRE input is restored across device classes before resuming broad deployment.

Final analysis — balancing security and recoverability​

The October KB5066835 incident is a clear, practical lesson: update security and update reliability are not independent variables. A cumulative rollup that “works” in the running desktop but breaks the recovery environment dramatically shifts the risk calculus for administrators and ordinary users alike. The right organizational posture is defensive and surgical:
  • Preserve recovery media and BitLocker keys.
  • Pause automatic deployment where recovery‑critical endpoints cannot tolerate the temporary loss of WinRE.
  • Test vendor fixes in representative pilot rings that include hardware with diverse USB host controllers.
  • Demand stronger WinRE and Safe OS validation from vendors and from internal QA pipelines.
This episode will likely accelerate discussion across the Windows management community about how Safe OS images are validated, how rollbacks should be implemented for pre‑boot components, and how combined servicing packages should be handled in enterprise fleets. Until Microsoft’s formal remediation is widely validated, the most defensible approach is conservative: protect recoverability first, patch decisively only after a tested fix is confirmed, and treat recovery tooling as essential infrastructure rather than an afterthought.

The operational message for every Windows user and administrator remains straightforward and urgent: validate your recovery options now — create a bootable Windows recovery USB, secure BitLocker keys, and stage update deployments — because when the recovery path breaks, the cost of that failure can be far greater than the value of a single monthly patch.

Source: PCWorld Windows 11's October update breaks keyboard and mice, Microsoft warns
Source: findarticles.com Windows 11 October Update Breaks Recovery Mode Input
 
Microsoft has confirmed that the October cumulative update for Windows 11 (KB5066835), shipped alongside the 25H2 rollout, introduced a regression that prevents USB keyboards and mice from functioning inside the Windows Recovery Environment (WinRE), leaving the very tools meant to repair broken systems difficult or impossible to operate for many users.

Background​

The Windows Recovery Environment (WinRE) is the lightweight, pre‑boot toolkit built into Windows that provides Startup Repair, Safe Mode, Command Prompt access, System Restore, and other diagnostic tools outside the main OS. When WinRE is inaccessible or input devices don’t work there, administrators and ordinary users alike can be locked out of crucial recovery operations. Microsoft flagged the WinRE input problem after the cumulative security update released on October 14, 2025 (KB5066835) and opened a formal known‑issues entry for Windows 11 versions 25H2 and 24H2 and Windows Server. Microsoft says a fix is being prepared.

What Microsoft officially says​

Microsoft’s Windows 11 release‑health page lists the issue under the 25H2 known issues: after installing KB5066835 (OS build 26100.6899), USB devices such as keyboards and mice “do not function in the Windows Recovery Environment (WinRE),” though those same devices continue to work normally inside the full Windows desktop. Microsoft’s immediate guidance is short: the company is “working to release a solution to resolve this issue in the coming days.” That timeline is deliberately vague and has left some organizations scrambling for short‑term mitigations.

What’s happening and who is affected​

  • The update in question: KB5066835, part of October 2025 cumulative/security releases for Windows 11. Microsoft lists the originating build as 26100.6899.
  • Affected platforms: Windows 11, version 25H2; Windows 11, version 24H2; and Windows Server 2025 instances that received the same cumulative.
  • Symptom profile: users report either a completely unresponsive mouse/keyboard inside WinRE or severe input lag when the environment is reached. Reports come from multiple communities (Microsoft Q&A, Reddit, and independent tech outlets), and the behavior can vary by hardware, BIOS/UEFI USB settings, and whether machines use USB‑only ports (no PS/2).

Observed variance: unresponsive vs lagging input​

Different testers report slightly different behaviors. Some users say input is entirely undetected in WinRE (no pointer, no keystroke response), while other more controlled tests show sluggish response with multi‑second delays between keystrokes or clicks and WinRE action. Because WinRE uses a slimmed‑down driver set, the problem likely ties back to a driver/WinRE image regression introduced by the cumulative package. The anecdotal lag measurement reported by one outlet (roughly four seconds per input) is a single test case and should be treated as anecdote rather than definitive performance characterization across all hardware. Independent user threads indicate complete absence of input on many machines.

Technical analysis: why WinRE is fragile and why this update likely caused trouble​

WinRE runs a minimal environment based on a compact WinPE/WinRE image (winre.wim) that bundles only a subset of drivers and services to reduce footprint and speed boot. That lightweight approach means recovery mode relies on a narrow set of device drivers; if a cumulative update changes the expected USB stack, security components, or replaces the WinRE image without including the correct USB host drivers (especially for USB 3.x controllers), the recovery environment can boot without functional input. Reports and Microsoft’s own acknowledgment point to exactly that: the desktop loads broad device support and so USB peripherals still work there, but the WinRE image no longer exposes the USB devices in some configurations.
Key technical contributors to the failure:
  • WinRE’s trimmed driver set can be incomplete for newer USB controllers (USB 3.x-only machines, some NUCs or ultralight laptops).
  • Cumulative updates sometimes update the WinRE image (winre.wim) as part of servicing; an error in packaging or an omitted driver can break input in the recovery layer while leaving the main OS intact.
  • Systems using legacy PS/2 ports are less commonly affected because PS/2 driver support is simpler and often built into the firmware/legacy stack. Multiple reports show PS/2 peripherals or bootable external media (which include full driver sets) remain usable.

Impact assessment: how bad is this, really?​

  • For casual users who never need WinRE, the practical effect may be minimal because their machine rarely touches recovery mode.
  • For users who rely on recovery tools for tasks like Safe Mode, Startup Repair, CHKDSK, BIOS access, or rolling back drivers, this is a critical problem: if the PC refuses to boot normally, WinRE is often the only way to start repair or roll back problematic drivers.
  • For IT staff and system administrators, this bug creates operational risk: imaging, emergency repairs, and remote troubleshooting often depend on WinRE accessibility or locally booting to recovery media. Organizations that rely on centralized patching or automatic updates may find multiple endpoints unusable for standard recovery workflows until a fix is applied. Community reports show IT teams encountering Saturday/Sunday firefights as admins scrambled for workarounds.

Severity ranking (practical terms)​

  • Critical if your device is currently unbootable and you need WinRE to repair it.
  • High for IT teams managing fleets where recovery tooling is part of standard OS maintenance.
  • Medium for power users who can create bootable recovery media or use PS/2 peripherals as a stopgap.
  • Low for casual users with stable desktops who rarely need recovery tools.

What to do now: practical mitigation and recovery options​

Below are prioritized, actionable steps for home users, power users, and IT admins. Each step is presented with caveats and effort levels.

Immediate, low‑risk actions​

  • Pause updates
  • Pause Windows Update to prevent reinstallation of the problematic cumulative while you troubleshoot. (Settings → Windows Update → Pause updates). This prevents repeated reinstallations while you apply a temporary mitigation.
  • Check whether you have the update installed
  • Check installed updates via Settings → Windows Update → Update history or use WMIC/PowerShell to list updates (wmic qfe list or Get-HotFix in PowerShell). If you see KB5066835, you match the configuration Microsoft flagged.
  • Try an alternate way into firmware/advanced boot
  • If WinRE is unresponsive but you need BIOS/UEFI, use the traditional firmware key (Del, F2, F12, Esc, or the vendor’s key) at POST to enter UEFI/BIOS. Many systems allow direct access there without going through WinRE. Reddit threads show this as a practical bypass when WinRE input is dead.

Recommended short-term fixes (moderate risk / moderately technical)​

  • Boot from official Windows installation media (recommended)
  • Creating a Windows 11 USB installer gives you the same recovery tools but uses the installer’s WinPE image that typically contains broader driver support than the local WinRE. This lets you access Command Prompt, Startup Repair, and other recovery tools without relying on the broken local WinRE. Download or create the media using Microsoft’s Download Windows 11 page or the Media Creation Tool; if the official tool is temporarily unstable, you can download the ISO and create bootable media with Rufus or other utilities.
Steps (high level):
  • Download Windows 11 ISO from Microsoft’s download site.
  • Use Rufus or the Media Creation Tool to create a bootable USB.
  • Boot from USB (change boot order or use the boot menu) and select Repair your computer → Troubleshoot → Advanced options.
  • Uninstall the problematic update (if available)
  • If Windows allows, uninstall KB5066835 via Settings → Windows Update → Update history → Uninstall updates. Some users reported successful rollbacks that restored WinRE functionality; others noted that cumulative uninstall options can be limited depending on how the update was packaged. If Settings doesn’t show the update, administrative PowerShell or DISM commands may be required. Always pause updates afterward to avoid reinstallation until Microsoft issues a fix.
Caution: Uninstalling cumulative updates may not always be possible on every system, and removing certain security updates can expose the device to known vulnerabilities. Balance risk and urgency: if a system is unusable, a rollback may be acceptable; for healthy systems, waiting for the official patch is often the safer option.
  • Use legacy boot options to access Safe Mode (if the goal is Safe Mode and not full WinRE)
  • You can enable legacy boot menu behavior from within Windows using:
    bcdedit /set {default} bootmenupolicy legacy
  • Reboot and press F8 to access the legacy menu. This bypasses the modern WinRE tile UI but won’t fix WinRE itself. Community threads show this as a useful workaround to access Safe Mode without relying on the broken advanced startup UI.

Advanced recovery (higher risk, for sysadmins and experienced users)​

  • Replace WinRE image (winre.wim) with a working copy
  • Experienced administrators can mount the Recovery partition, export a working winre.wim from a known good ISO, replace the damaged local WinRE image, and re‑register WinRE with reagentc. This process uses DISM/PowerShell and requires careful steps:
  • Mount the Windows ISO, extract a clean winre.wim from the sources/boot.wim or recovery image.
  • Mount the recovery partition and replace \Recovery\WindowsRE\winre.wim with the clean copy.
  • Run reagentc /setreimage /path <path-to-winre> and reagentc /enable to reconfigure WinRE.
  • This approach has restored recovery input for some users but is risky: a mistaken operation can leave the system unbootable. Back up system images before attempting. Tech articles and enterprise blogs outline the DISM/Add‑driver workflow for customizing WinRE.
  • Inject USB drivers into WinRE
  • If your hardware uses a USB 3.x controller that is missing from WinRE, you can mount the winre.wim, add the correct .inf driver packages with DISM/Add-WindowsDriver or Add-WindowsDriver PowerShell commands, then unmount and save. This customizes WinRE to include required USB host drivers.
  • High‑risk, high‑reward: effective when the issue is a missing driver, but dangerous if done incorrectly. Comprehensive walkthroughs exist for mounting WinPE/WinRE and adding drivers, and the typical sequence involves exporting drivers from the running system (dism /online /export-driver) then injecting them into the mounted image.

Official Microsoft response and likely remediation timeline​

Microsoft’s public stance (as of the known‑issues entry last updated October 17, 2025) is that the company is working on a resolution and plans to ship an update to correct WinRE input problems. Microsoft has historically addressed severe regressions in out‑of‑band updates when the issue affects recovery capabilities or data integrity. Based on past practice, a targeted out‑of‑band cumulative or a servicing stack update could appear within days to a couple of weeks, but Microsoft’s published message only committed to “coming days” without a precise date. Admins should monitor Microsoft’s release‑health page for formal patch announcements and test fixes in a controlled lab before mass rollout.

Risks and cautionary notes​

  • Do not attempt risky modifications to Recovery partitions without current, tested backups. Replacing winre.wim or editing partitions can prevent OS boot if done incorrectly.
  • Uninstalling security updates removes protection; weigh the ability to repair or access recovery tools against the security exposure that may result.
  • Manufacturer firmware settings (BIOS/UEFI USB legacy support, Fast Boot) interact with WinRE behavior; toggling them can help, but also can complicate diagnostics. Document any setting changes so you can revert them.
  • Some community "fixes" circulated on forums and Reddit can be effective but may void support or introduce instability. Prefer official Microsoft guidance or lab‑tested procedures for production machines.

Recommended playbook for IT teams​

  • Inventory: identify which endpoints have installed KB5066835 (use your patch management console, WMIC/Get-HotFix).
  • Triage: prioritize systems that are critical, have remote users with no local support, or depend on WinRE (imaging workflows, kiosk machines).
  • Containment: pause Windows Update and disable automatic reboots for high‑value devices while testing remediations.
  • Mitigate: prepare bootable Windows 11 install media and documented steps to perform offline repairs; keep spare PS/2 keyboards or USB‑to‑PS/2 adapters handy for workstations that accept them.
  • Test and deploy: once Microsoft publishes an official fix, validate the out‑of‑band update in a test ring before broad deployment.
  • Communicate: notify end users and helpdesk staff about the issue, the temporary mitigations, and expected follow‑up; provide step‑by‑step guides for creating recovery media and rolling back updates where safe.

Why this keeps happening: a broader reliability discussion​

Cumulative servicing is efficient for security but increases complexity: a single cumulative package can touch kernel components, the HTTP stack, WinRE images, SSUs, and other subsystems in one shot. That density raises the blast radius when a packaging error or test gap slips through. Windows runs across a wider hardware matrix than many proprietary OSes; combined with faster release cadence and rising user expectations, regressions that affect recovery tooling attract justified attention.
There’s also a human element: many end users and small IT teams rely on WinRE as a safety net. When that safety net is degraded, the perceived severity of even a non‑data‑loss bug skyrockets. The WinRE regression highlights that quality gates for recovery tooling deserve an elevated role in Microsoft’s release validation, because recovery is the last line between a recoverable problem and a full reinstall. Independent outlets and community reports are already pushing for clearer runbooks and stricter pre‑release checks for recovery functionality.

Bottom line​

The October 14, 2025 cumulative update (KB5066835, build 26100.6899) introduced a WinRE regression that prevents or severely degrades USB keyboard and mouse input inside the Windows Recovery Environment for many Windows 11 24H2/25H2 and Windows Server installations. Microsoft has acknowledged the problem and says a fix is forthcoming, but until that fix lands, affected users should rely on bootable Windows installer media, PS/2 or alternate input, or carefully executed recovery‑image replacements as short‑term mitigations. Administrators should inventory affected systems, pause automatic updates where appropriate, and prepare validated recovery USBs. Avoid risky Recovery‑partition edits unless you have backups and the requisite expertise.
The situation is inconvenient, avoidable with cautious patching policy, and fixable — but it is a blunt reminder that recovery deserves priority testing. Expect Microsoft to issue an out‑of‑band remediation; track the Windows release‑health page for the official patch announcement and validate fixes in a test ring before broad deployment.

Source: PC Gamer Windows 11 25H2 has borked the mouse and keyboard controls in the Windows Recovery Environment, because what would a major update be without a fresh batch of bugs