Microsoft .NET: Remote code execution via deserialization

Summary

Deserialization of untrusted data in .NET allows an unauthenticated remote attacker to execute code. The affected components include the .NET 8, 9, 10 and 11 runtimes, .NET Framework 3.5 and 4.6.2 to 4.8.1, and Visual Studio 2022 17.14 and 2026 18.10. Microsoft rates it CVSS 8.8 (High). Per third-party research, exploitation requires a user to open attacker-supplied content in a WPF application and follow a link in it.

Affected

• Microsoft .NET 8.0 before 8.0.32
• Microsoft .NET 9.0 before 9.0.21
• Microsoft .NET 10.0 before 10.0.13
• Microsoft .NET 11.0 from 11.0.0 before 11.0.0-rc.2
• Microsoft .NET Framework 3.5 and 4.6.2 to 4.8.1 (exact builds: see MSRC)
• Microsoft Visual Studio 2022 version 17.14 before 17.14.42
• Microsoft Visual Studio 2026 version 18.10 before 18.10.4
• Microsoft .NET 6 is not assessed by Microsoft; third-party research reports it is affected

Fixed in

• .NET 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2 or later
• .NET Framework: October 13, 2026 security update via Windows Update or WSUS (exact build numbers: Unknown, verify on MSRC)
• Visual Studio 2022 17.14.42 or later; Visual Studio 2026 18.10.4 or later
• .NET 6: Unknown from Microsoft; a paid third-party fix (NES for .NET 6.0.47) is reported by HeroDevs

Workaround

• No vendor-documented workaround found. Unknown.
• Microsoft advises installing the latest .NET version and updating package references to the patched version in applications that use the affected package.

Exploitation

• Microsoft marks the vulnerability as not exploited.
• Not listed in the CISA KEV catalog.
• EPSS scores vary by source (1.3% to about 1.3 percent in one record).
• No public proof-of-concept found in research; this does not prove none exists.

Our recommendation

• Patch .NET Framework via Windows Update or WSUS with the October 13, 2026 update.
• Update .NET runtimes and Visual Studio to the fixed versions listed above.
• Prioritise systems running custom WPF or XAML-based applications and any .NET 6 applications, which have no official Microsoft fix.
• Verify installed versions with an inventory check and confirm the exact fixed .NET Framework builds on the MSRC Security Updates table.
• Restrict users from opening untrusted documents and links in desktop applications, and monitor for phishing attempts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70035 msrc.microsoft.com
• GitHub Advisory GHSA-4j9v-h7pp-725h github.com
• dotnet/announcements #451 github.com
• Microsoft Support KB5127696: .NET Framework 3.5, October 13, 2026 support.microsoft.com
• GitLab Advisory Database: CVE-2026-70035 advisories.gitlab.com
• HeroDevs Vulnerability Directory: CVE-2026-70035 (third party) www.herodevs.com
• OpenCVE: CVE-2026-70035 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:01.