Zero Radar
← feed
HighVulnerabilityCVE-2026-70197updated 25 Oct 2026, 18:36 UTC

Microsoft .NET runtime on Windows can be abused to run attacker code remotely

A flaw in the software that runs .NET apps on Windows could let an outsider send specially crafted input over the network and run their own code on the machine. Microsoft has not yet released a complete fix.

Partial fixOfficial, 3 sources
SeverityHighCVSS 8.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Partly8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2 (per package listings). Microsoft's MSRC advisory states the vulnerability has not yet been fully addressed and a complete mitigation is still being prepared, so the listed versions may not yet contain the final fix. · since 25 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends crafted input over the network
  2. 2Vulnerable .NET appProcesses the input in the runtime
  3. 3Out-of-bounds writeMemory is written past its boundary
  4. 4Code executionAttacker code runs on the machine
  5. ResultAttacker runs code on the Windows machine

What happened

An out-of-bounds write in the .NET runtime (Microsoft.NETCore.App.Runtime for win-x64, win-x86, and win-arm64) allows an unauthorized network attacker to execute code.

Why it is dangerous: Anyone running affected .NET apps on Windows could have their machine taken over by a remote attacker, without needing a login. Servers and internet-facing apps are at the highest risk.

Are you affected?

You are affected if you run Windows apps built on or deployed with a vulnerable .NET runtime package: 8.0.0 to before 8.0.32, 9.0.0 to before 9.0.21, 10.0.0 to before 10.0.13, or 11.0.0-preview.1 to before 11.0.0-rc.2.

Package / productAffected versionsFixed in
Microsoft.NETCore.App.Runtime.win-arm64 · nuget>= 8.0.0, < 8.0.328.0.32
Microsoft.NETCore.App.Runtime.win-x64 · nuget>= 8.0.0, < 8.0.328.0.32
Microsoft.NETCore.App.Runtime.win-x86 · nuget>= 8.0.0, < 8.0.328.0.32
Microsoft.NETCore.App.Runtime.win-arm64 · nuget>= 11.0.0-preview.1, < 11.0.0-rc.211.0.0-rc.2
Microsoft.NETCore.App.Runtime.win-x64 · nuget>= 11.0.0-preview.1, < 11.0.0-rc.211.0.0-rc.2
Microsoft.NETCore.App.Runtime.win-x86 · nuget>= 11.0.0-preview.1, < 11.0.0-rc.211.0.0-rc.2
Microsoft.NETCore.App.Runtime.win-arm64 · nuget>= 9.0.0, < 9.0.219.0.21
Microsoft.NETCore.App.Runtime.win-x64 · nuget>= 9.0.0, < 9.0.219.0.21
Microsoft.NETCore.App.Runtime.win-x86 · nuget>= 9.0.0, < 9.0.219.0.21
Microsoft.NETCore.App.Runtime.win-arm64 · nuget>= 10.0.0, < 10.0.1310.0.13
Microsoft.NETCore.App.Runtime.win-x64 · nuget>= 10.0.0, < 10.0.1310.0.13
Microsoft.NETCore.App.Runtime.win-x86 · nuget>= 10.0.0, < 10.0.1310.0.13

What to do

  1. Check which .NET runtime versions your Windows apps use and identify any listed as vulnerable.
  2. Update to the fixed versions (8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2) as soon as they are available for your version line.
  3. Watch the Microsoft MSRC advisory for the complete mitigation and install it when released.
  4. Restrict network exposure of affected services until patched.

Timeline

  1. 13 Oct 2026, 19:19 UTC
    Publicly disclosed
  2. 19 Oct 2026, 14:00 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  3. 25 Oct 2026, 18:20 UTC
    NVD reported on it · NVD
  4. 25 Oct 2026, 18:35 UTC
    OSV reported on it · OSV
  5. 25 Oct 2026, 18:35 UTC
    Fixed version published: Microsoft.NETCore.App.Runtime.win-arm64 8.0.32, Microsoft.NETCore.App.Runtime.win-x64 8.0.32, Microsoft.NETCore.App.Runtime.win-x86 8.0.32 · OSV
  6. 25 Oct 2026, 18:36 UTC
    Fix: 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2 (per package listings). Microsoft's MSRC advisory states the vulnerability has not yet been fully addressed and a complete mitigation is still being prepared, so the listed versions may not yet contain the final fix.

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-70197
CVSS
8.1 / 10
EPSS
0.8% chance of exploitation within 30 days
Disclosed
13 Oct 2026, 19:19 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:36 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Microsoft .NET runtime on Windows can be abused to run attacker code remotely · Zero Radar