Windows 11 Update KB5120998 Triggers Cursor Bugs and Defender False Positives
Optional preview update KB5120998 is resetting user mouse customizations and triggering erroneous security alerts.
A Windows 11 update released on August 27 has introduced regressions that scramble user interface customizations and trigger erroneous security warnings. The bugs affect both the visual experience of the desktop and the reliability of the system's built-in antivirus.
The issues are linked to the optional preview update KB5120998. According to reports from The Register, the patch is causing custom mouse pointers to be reset to defaults or corrupted entirely. Simultaneously, Microsoft Defender has begun producing a significant number of false positive security alerts, flagging benign files as threats.
The Context of Regressions
Windows updates frequently introduce regressions in security heuristics and UI customization. While the August 27 update was intended as a standard maintenance or security patch, the resulting instability in the pointer system and Defender's detection engine suggests a lack of comprehensive regression testing for these specific components. Such errors often occur when updates to the kernel or system libraries inadvertently overwrite user-defined registry keys or alter the sensitivity of security scanning engines.
Why It Matters
These bugs represent more than mere inconveniences. Cursor customizations are often critical for accessibility, allowing users with visual impairments to navigate the OS more effectively. When these settings are corrupted, productivity is directly impacted.
More concerning is the surge in 'bogus' alerts from Microsoft Defender. In the cybersecurity industry, this phenomenon leads to "alert fatigue," where users are bombarded with so many false alarms that they begin to ignore notifications. This creates a dangerous security gap, as users may overlook a genuine threat or be tempted to disable their security software entirely to stop the interruptions.
What's Next
Microsoft has not yet released a formal fix for KB5120998. Users experiencing these issues may need to uninstall the optional update via the Windows Update history menu to restore their cursor settings and silence the false alerts. It remains to be seen if these bugs will be rolled into the next mandatory cumulative update or if a separate hotfix will be deployed to stabilize Defender's detection engine.