Skip to content
fr Sign in
7.8 High

CVE-2026-70354 Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally

Description

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

Affected products and versions

Product Affected versions Fixed in
.NET 10.0 10.0 10.0.0 → < 10.0.11 10.0.11
.NET 8.0 8.0 8.0.0 → < 8.0.30 8.0.30
.NET 9.0 9.0 9.0.0 → < 9.0.19 9.0.19
Microsoft .NET Framework 3.5 3.5 3.5.0 → latest No fix stated
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0 3.0.0.0 → latest No fix stated
Microsoft .NET Framework 3.5 AND 4.7.2 4.7 4.7.0 → latest No fix stated
Microsoft .NET Framework 3.5 AND 4.8 4.8 4.8.0 → latest No fix stated
Microsoft .NET Framework 3.5 AND 4.8.1 4.8 4.8.1 → latest No fix stated
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7 4.7.0 → < 4.7.4144.0 4.7.4144.0
Show the 7 other branches
Product Affected versions Fixed in
Microsoft .NET Framework 4.8 4.8 4.8.0 → < 4.8.4805.0 4.8.4805.0
Microsoft .NET Framework 4.8.1 4.8 4.8.0.0 → < 4.8.9344.0 4.8.9344.0
Microsoft Visual Studio 2022 version 17.14 17.14 17.14.0 → < 17.14.38 17.14.38
Microsoft Visual Studio 2026 version 18.8 18.0 18.0 → < 18.8.3 18.8.3
.NET 10.0 runtime 10.0 10.0.0 → < 10.0.11 10.0.11
.NET 8.0 runtime 8.0 8.0.0 → < 8.0.30 8.0.30
.NET 9.0 runtime 9.0 9.0.0 → < 9.0.19 9.0.19

References

Timeline

  1. Published
  2. Last modified

Other CVEs of .NET 10.0

The 70 CVEs of .NET 10.0 →
CVE-2026-105016 Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network 9.8 Critical CVE-2026-58280 Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network 7.5 High CVE-2026-96957 Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature… 8.8 High CVE-2026-96233 Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network 7.5 High
Track this CVE