Update .NET Runtimes to Fix High-Severity Out-of-Bounds Write in System.Net.Sockets
Windows applications using .NET 8 through 11 must update NuGet packages to address CVE-2026-70197, a high-severity remote code execution flaw in socket handling.
Key points
- Microsoft released patches for CVE-2026-70197, a high-severity out-of-bounds write vulnerability in System.Net.Sockets.
- The flaw allows unauthenticated attackers to execute code remotely on Windows systems via network requests.
- Affected versions span .NET 8, 9, 10, and 11, with specific patched versions available for each release line.
Microsoft has addressed a high-severity remote code execution vulnerability in the .NET runtime, identified as CVE-2026-70197. The flaw resides in System.Net.Sockets and involves an out-of-bounds write error that occurs when handling network datagrams. According to the official advisory, an unauthenticated attacker can exploit this issue over a network to execute arbitrary code on a target system. The vulnerability is rated high severity with a CVSS score of 8.1.
The risk
The technical root cause involves how the .NET runtime manages socket buffers on Windows. Specifically, reusing a SocketAsyncEventArgs instance across both IPv4 and IPv6 datagram sockets can retain an undersized cached native address buffer. When the application subsequently calls ReceiveFromAsync, this condition allows an out-of-bounds write to occur. This memory corruption enables remote code execution without requiring prior authentication or user interaction. The vulnerability affects all Windows architectures supported by the affected .NET versions.
Who is exposed
Developers and operators using Microsoft .NET on Windows are exposed if they run specific vulnerable package versions. The vulnerability affects Microsoft.NETCore.App.Runtime packages for arm, arm64, x64, and x86 architectures. For .NET 8, versions from 8.0.0 through 8.0.31 are vulnerable. For .NET 9, versions 9.0.0 through 9.0.20 are affected. For .NET 10, versions 10.0.0 through 10.0.12 are vulnerable. Additionally, early release versions of .NET 11, specifically from 11.0.0-preview.1 through 11.0.0-rc.1, are also affected.
Cost and compliance
The source material does not provide specific financial impact data or regulatory compliance implications. However, the high severity rating and remote code execution capability suggest significant operational risk. Organizations must evaluate their exposure based on their deployment of affected .NET versions. Compliance frameworks that mandate timely patching of high-severity vulnerabilities will likely require immediate action.
Our take on the response
Microsoft has provided clear version boundaries for the vulnerability and corresponding patched versions. This clarity allows teams to quickly identify affected assets. The availability of patches for all affected .NET lines reduces the window of exposure. Teams should prioritize updating production environments immediately, as the flaw allows unauthenticated remote code execution.
What defenders should look for
Security operations teams should monitor for unusual socket behavior in .NET applications. Look for instances where socket arguments are reused across different IP protocol versions. Alerts related to out-of-bounds memory writes or unexpected process spawns in network-facing applications should be investigated. Check whether applications are handling both IPv4 and IPv6 datagrams simultaneously. Containment may involve isolating affected hosts or restricting network access to vulnerable services until patches are applied. Monitor for signs of remote code execution following network activity.
What to do and how to stay safe: Microsoft
- Check your inventory for Microsoft.NETCore.App.Runtime packages on Windows systems.
- Compare installed versions against the vulnerable ranges listed in the advisory.
- Update to the specific patched versions provided for each .NET release line.
- Monitor network logs for anomalous socket activity following the update.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-70197?
.NET 8, 9, 10, and specific preview/RC versions of .NET 11 are affected.
What is the severity of this vulnerability?
The vulnerability is rated high severity with a CVSS score of 8.1.
Is there a patch available for this flaw?
Yes, Microsoft has released patched versions for all affected .NET runtime packages.
