Skip to content
fr Sign in
7.5 High

CVE-2026-96233 Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network

Description

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products and versions

Product Affected versions Fixed in
.NET 10.0 10.0 10.0.0 → < 10.0.13 10.0.13
.NET 11.0 11.0 earliest → < 11.0.0-rc.2 11.0.0-rc.2
.NET 8.0 8.0 8.0.0 → < 8.0.32 8.0.32
.NET 9.0 9.0 9.0.0 → < 9.0.21 9.0.21
Microsoft .NET Framework 3.5 3.5 3.5.0 → latest No fix stated
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0 3.0.0.0 → latest No fix stated
Microsoft .NET Framework 3.5 AND 4.7.2 4.7 4.7.0 → latest No fix stated
Microsoft .NET Framework 3.5 AND 4.8 4.8 4.8.0 → latest No fix stated
Microsoft .NET Framework 3.5 AND 4.8.1 4.8 4.8.1 → latest No fix stated
Show the 7 other branches
Product Affected versions Fixed in
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7 4.7.0 → < 4.7.4150.0 4.7.4150.0
Microsoft .NET Framework 4.8 4.8 4.8.0 → < 4.8.4811.0 4.8.4811.0
Microsoft .NET Framework 4.8.1 4.8 4.8.0.0 → < 4.8.9363.0 4.8.9363.0
.NET 10.0 runtime 10.0 10.0.0 → < 10.0.13 10.0.13
.NET 11.0 runtime 11.0 earliest → < 11.0.0-rc.2 11.0.0-rc.2
.NET 8.0 runtime 8.0 8.0.0 → < 8.0.32 8.0.32
.NET 9.0 runtime 9.0 9.0.0 → < 9.0.21 9.0.21

References

Timeline

  1. Published
  2. Last modified

Other CVEs of .NET 10.0

The 70 CVEs of .NET 10.0 →
CVE-2026-105016 Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network 9.8 Critical CVE-2026-58280 Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network 7.5 High CVE-2026-96957 Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature… 8.8 High CVE-2026-96232 Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network 7.5 High
Track this CVE