Microsoft .NET: Out-of-bounds write enables remote code execution

Summary

Microsoft .NET contains an out-of-bounds write (CWE-787) in the System.Net.Sockets networking code that affects Windows systems. An unauthenticated attacker on the network can write outside a buffer and may execute code; Microsoft rates the flaw Important (CVSS 8.1). The bug is triggered when application code reuses a SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets for UDP receives, so exposure depends on the applications in use.

Affected

• Microsoft .NET 8.0, 9.0, 10.0 and 11.0 (preview and RC builds) installed on Windows, per the CVE record; the vendor advisory revision of 25 October 2026 limits the Windows .NET 8 runtime range to versions before 8.0.33
• Microsoft .NET 10.0 and 11.0 runtime packages, per the CVE record
• Linux and macOS installations are listed in the CVE record; Ubuntu marks dotnet8 as not affected on 24.04 and 22.04
• Visual Studio: affected, exact build numbers unknown

Fixed in

• .NET 8: 8.0.33 Runtime, or 8.0.133 or 8.0.427 SDK
• .NET 10: 10.0.14 Runtime, or 10.0.114 or 10.0.403 SDK
• .NET 11: 11.0.0-rc.3 Runtime or 11.0.100-rc.3 SDK (release candidate)
• .NET 9: Unknown; check the vendor advisory
• Visual Studio: Patched in two release lines, exact builds unknown; check the vendor advisory

Workaround

Unknown. No vendor-documented workaround is available; the vendor remedy is patching. A third-party WAF rule has been listed but is unverified and is not a substitute for patching.

Exploitation

• No confirmed exploitation in the wild known at the time of research
• CISA SSVC: exploitation none, automatable no
• Not listed in CISA KEV according to a third-party source
• No public proof of concept found; this does not prove none exists
• EPSS 0.00788 (low predicted exploitation probability)
• NVD status was still Awaiting Analysis at the time of research

Our recommendation

• Inventory all .NET 8, 9, 10 and 11 runtimes and SDKs on Windows servers and workstations, including self-contained applications that bundle their own runtime
• Install the October 25, 2026 builds listed above; for .NET 9 and Visual Studio, check the vendor advisory for the fixed version
• Rebuild and redeploy self-contained applications so they pick up the fixed runtime
• Identify applications that receive UDP data and prioritise internet-facing or network-reachable services
• Ask vendors of Windows .NET products whether they are affected and when updated builds will be available
• Verify the installed build after patching, since the first October 13 release lacked the .NET 8 fix

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70197 msrc.microsoft.com
• GitHub Security Advisory GHSA-4mpw-cpwj-hxxj (dotnet/runtime) github.com
• dotnet/announcements issue 493 github.com
• Microsoft .NET 8 update October 25, 2026 support.microsoft.com
• Infosecurity Magazine: Microsoft patch update .NET flaw www.infosecurity-magazine.com
• Ubuntu CVE tracker: CVE-2026-70197 ubuntu.com
• Miggo vulnerability database: CVE-2026-70197 www.miggo.io
• Vulners NVD record: CVE-2026-70197 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:31.