Microsoft Fixes Critical .NET Socket Flaw Allowing Unauthenticated Remote Code Execution on Windows

Microsoft has released security updates for its .NET runtime on Windows to address a high-severity vulnerability identified as CVE-2026-70197. The flaw exists in the System.Net.Sockets component and allows an unauthenticated attacker to execute arbitrary code. This follows a pattern of recent critical updates from major software vendors, similar to recent patches for Adobe AEM and Citrix NetScaler, requiring immediate attention from operations teams.

What is the technical nature of this vulnerability?

The issue stems from an out-of-bounds write error within the System.Net.Sockets library on Windows systems. According to the GitHub advisory, the problem occurs when an application reuses a `SocketAsyncEventArgs` instance across both IPv4 and IPv6 datagram sockets. This reuse can cause the system to retain an undersized cached native address buffer.

How does an attacker exploit this flaw?

An unauthenticated attacker can trigger the out-of-bounds write during the `ReceiveFromAsync` operation. The vulnerability has a CVSS score of 8.1, classified as high severity. The attack vector is network-based, meaning the attacker does not need prior access to the system or user credentials to attempt exploitation, though the attack complexity is rated as high.

Which specific versions and platforms are affected?

The vulnerability impacts Windows applications using Microsoft .NET runtimes. According to the Microsoft Security Update Guide, affected versions include .NET 8 (up to 8.0.31), .NET 9 (up to 9.0.20), and .NET 10 (up to 10.0.12). Early preview and release candidate versions of .NET 11 are also affected. Patches are available for all listed versions across ARM, ARM64, x64, and x86 architectures.

What immediate steps should operations teams take?

Teams should verify their inventory of Windows-based .NET applications to identify any running vulnerable runtime versions. Once identified, applications should be updated to the patched versions listed in the advisory, such as .NET 8.0.32 or .NET 9.0.21. The advisory provides guidance on what developers can do to update their applications to remove this vulnerability.

Questions to ask your suppliers

Operations teams should request confirmation that their vendors have assessed the impact of this .NET vulnerability on any delivered software. Ask suppliers whether their applications rely on the affected System.Net.Sockets components and if they have validated the fix in their own builds. Determine who within the organization needs to coordinate the update process, including development, infrastructure, and compliance teams. Ensure that change management protocols account for the urgency of this high-severity remote code execution risk.

Background: Citrix NetScaler vulnerabilities

Citrix NetScaler vulnerabilities allow attackers to bypass login screens and control the device. These flaws often stem from improper input validation or default settings. Users should verify patches, restrict access, and monitor logs to reduce risk.

Read the full guide: Citrix NetScaler Vulnerabilities Explained: Risks and Fixes

What to do and how to stay safe: Microsoft

• Audit all Windows servers and workstations to identify running versions of .NET 8, 9, 10, and 11 previews.
• Apply the latest runtime updates provided by Microsoft to replace vulnerable versions immediately.
• Review application code for reuse of SocketAsyncEventArgs across IPv4 and IPv6 sockets to mitigate risk before patching.
• Monitor system logs for unusual network socket behavior that may indicate exploitation attempts.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability present on Linux or macOS .NET runtimes?

No, the source material specifies that this vulnerability affects only Windows platforms across all architectures.

What is the CVSS score for CVE-2026-70197?

The vulnerability has a CVSS 3.1 score of 8.1, which is rated as high severity.

Are there any workarounds other than updating the runtime?

The advisory does not list specific workarounds other than updating to the patched versions; avoiding reuse of socket arguments may reduce risk.