.NET Remote Code Execution Vulnerability
Summary
| CVE | CVE-2026-96224 |
|---|---|
| State | PUBLISHED |
| Assigner | microsoft |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-13 19:21:48 UTC |
| Updated | 2026-10-22 22:19:55 UTC |
| Description | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.007380000 probability, percentile 0.540110000 (date 2026-10-22)
Problem Types: CWE-787 | CWE-787 CWE-787: Out-of-bounds Write
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Microsoft | .NET 10.0 Runtime | affected 10.0.0 10.0.13 custom | Not specified |
| CNA | Microsoft | .NET 11.0 Runtime | affected 11.0.0 11.0.0-rc.2 custom | Not specified |
| CNA | Microsoft | .NET 8.0 Runtime | affected 8.0.0 8.0.32 custom | Not specified |
| CNA | Microsoft | .NET 9.0 Runtime | affected 9.0.0 9.0.21 custom | Not specified |
| CNA | Microsoft | Microsoft .NET Framework 3.5 | affected 3.5.0 2.0.50727.9188 AND 3.0.30729.9171 custom | Windows 11 version 26H1, Windows Server 2012, Windows Server 2012 R2 |
| CNA | Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 | affected 3.0.0.0 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 custom | Windows 10 version 1607, Windows Server 2016, Windows Server 2019 |
| CNA | Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | affected 4.7.0 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 custom | Windows 10 version 1809 |
| CNA | Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | affected 4.8.0 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 custom | Windows 10 version 1809, Windows 10 version 21H2, Windows 10 version 22H2, Windows Server 2019, Windows Server 2022 |
| CNA | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | affected 4.8.1 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 custom | Windows 10 version 21H2, Windows 10 version 22H2, Windows 11 version 23H2, Windows 11 version 24H2, Windows 11 version 25H2, Windows 11 version 26H2, Windows Server 2022, Windows Server 2025 |
| CNA | Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | affected 4.7.0 4.7.4150.0 custom | Windows Server 2012, Windows Server 2012 R2 |
| CNA | Microsoft | Microsoft .NET Framework 4.8 | affected 4.8.0 4.8.4811.0 custom | Windows 10 version 1607, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 |
| CNA | Microsoft | Microsoft .NET Framework 4.8.1 | affected 4.8.0.0 4.8.9363.0 custom | Windows 11 version 26H1 |
| CNA | Microsoft | Microsoft Visual Studio 2022 Version 17.14 | affected 17.14.0 17.14.42 custom | Not specified |
| CNA | Microsoft | Microsoft Visual Studio 2026 Version 18.10 | affected 18.10.0 18.10.4 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96224 | [email protected] | msrc.microsoft.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.