Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability

Summary

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Sockets. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows, reusing a `SocketAsyncEventArgs` instance across IPv4 and IPv6 datagram sockets can retain an undersized cached native address buffer, allowing an unauthenticated out-of-bounds write during `ReceiveFromAsync`. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/466 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 8.1 - **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` - **Weakness:** CWE-787 (Out-of-bounds Write) ## Affected Platforms - **Platforms:** Windows - **Architectures:** All ## <a name="affected-packages"></a>Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 8.0.0, < 8.0.33 | 8.0.33 [Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, < 8.0.33 | 8.0.33 [Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, < 8.0.33 | 8.0.33 [Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, < 8.0.33 | 8.0.33 [Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [Microsoft.…

Remediation

1. Inventory every Microsoft.NETCore.App.Runtime.win-arm64 deployment, including staging.
2. Upgrade Microsoft.NETCore.App.Runtime.win-arm64 to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/advisories/GHSA-4mpw-cpwj-hxxj
• Referencehttps://github.com/dotnet/runtime/security/advisories/GHSA-4mpw-cpwj-hxxj
• Referencehttps://github.com/dotnet/announcements/issues/466
• Referencehttps://github.com/dotnet/runtime/issues/135702
• Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-70197
• Referencehttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70197
• Referencehttps://github.com/dotnet/announcements/issues/493
• Referencehttps://github.com/dotnet/runtime/issues/136445