Key points
- The flaw affects Microsoft .NET runtimes on Windows, specifically versions 8.0 through 10.0 and early previews of version 11.
- Microsoft has released patched versions for all affected branches, including 8.0.32, 9.0.21, and 10.0.13.
- The vulnerability is rated high severity with a CVSS score of 8.1 and enables remote code execution without authentication.
Microsoft has released updates to address a high-severity out-of-bounds write vulnerability in the .NET framework. The flaw, tracked as CVE-2026-70197, exists in the System.Net.Sockets component and affects Windows installations. According to the GitHub advisory, the issue allows an unauthorized attacker to execute code over a network. The vulnerability impacts multiple .NET versions, including the stable 8.0, 9.0, and 10.0 branches, as well as preview builds of version 11. Patches are now available for all affected package lines.
In plain English
The bug occurs when an application reuses a specific socket argument instance across different network protocols. On Windows systems, switching between IPv4 and IPv6 datagram sockets can cause the system to keep a cached address buffer that is too small. When the application later performs an asynchronous receive operation, it writes data beyond the limits of this undersized buffer. This out-of-bounds write can be exploited by an unauthenticated attacker to run arbitrary code on the host machine. The flaw does not require user interaction to trigger.
The background
The vulnerability is classified as CWE-787, an out-of-bounds write, and carries a CVSS 3.1 score of 8.1. The vector string indicates network access is required, but no privileges or user interaction are needed for exploitation. The impact includes high changes to confidentiality, integrity, and availability. This issue is distinct from recent critical flaws in Adobe products, such as the ColdFusion authorization bypass reported by Vuln Post in October 2026. Those Adobe issues involved different mechanisms and vendors, whereas this .NET flaw is specific to Microsoft's networking stack on Windows.
What changes now
Developers must update their Microsoft.NETCore.App.Runtime packages to the patched versions. For .NET 8.0, the fix is version 8.0.32. For .NET 9.0, the patched version is 9.0.21. Applications using .NET 10.0 should upgrade to 10.0.13. Those testing version 11 previews need to move to 11.0.0-rc.2. The updates cover all Windows architectures, including x86, x64, ARM, and ARM64. Teams should verify their project files reference the correct runtime packages and rebuild their applications after updating dependencies.
Who needs to act first
Security operations teams should prioritize updating public-facing services that handle network traffic. Systems exposed to the internet or untrusted internal networks carry the highest risk because the flaw allows remote exploitation without authentication. Before rolling out the patch, validate the update in a staging environment to ensure application compatibility. Back up current configurations and runtime versions to enable quick rollback if issues arise. Monitor logs for unusual network activity or failed connection attempts during the transition period to detect potential exploitation attempts.
What to do and how to stay safe: Microsoft
- Audit your inventory to identify all Windows servers and workstations running affected .NET runtime versions.
- Update package references in project files to the patched versions listed in the advisory.
- Rebuild and test applications in a non-production environment before deploying the changes broadly.
- Monitor network logs for anomalies that could indicate exploitation attempts while updates are pending.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-70197?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1 are affected.
Is there a patch available for this vulnerability?
Yes, Microsoft has released patched versions including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2 for the respective branches.
What is the severity rating of this flaw?
The vulnerability is rated high severity with a CVSS 3.1 score of 8.1.
