Microsoft releases fixes for .NET Core 8-11 CVE-2026-96233 Hebrew parsing out-of-bounds crash

Microsoft has released security updates to address a high-severity denial-of-service vulnerability in ASP.NET Core applications. The flaw, identified as CVE-2026-96233, affects the System.Runtime component and allows an unauthorized network attacker to terminate processes. According to the Microsoft Security Update Guide, the issue exists in DateTime parsing logic that can read outside expected stack bounds. This impacts organizations running .NET Core versions 8 through 11 on Windows, Linux and macOS platforms.

How does the vulnerability work?

The root cause is an out-of-bounds write weakness, classified as CWE-787. When an application processes specific DateTime inputs involving Hebrew-number parsing, the code may access memory regions outside the intended stack boundaries. This irregular memory access causes the application process to terminate abruptly. According to GitHub advisory GHSA-87vj-4hqv-22p9, this behavior enables a remote attacker to deny service without needing authentication. The CVSS 3.1 score is 7.5, reflecting the ease of network exploitation and lack of required user interaction.

Which versions and platforms are affected?

The vulnerability impacts multiple major releases of the Microsoft .NET Core runtime. Affected versions include .NET Core 8 up to 8.0.31, .NET Core 9 up to 9.0.20, .NET Core 10 up to 10.0.12 and preview releases of .NET Core 11 up to 11.0.0-rc.1. Microsoft has provided patched versions for all these branches: 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2. The issue spans all supported architectures, including ARM, ARM64, x64 and x86 on Windows, Linux and macOS operating systems.

What are the operational risks?

Security operations teams should assess the exposure of any public-facing services built on these affected .NET Core versions. Because the attack vector is network-based and requires no authentication, any internet-exposed API or web service using the vulnerable runtime is at risk. The consequence is process termination, which leads to service unavailability. That suggests teams with high-availability requirements should prioritize patching to prevent potential downtime during exploitation attempts.

Questions to ask your suppliers

Organizations should contact vendors providing managed .NET Core services to confirm their patching status. Ask whether their infrastructure includes any affected runtime versions and when updates will be applied. Request details on how they monitor for process crashes related to DateTime parsing anomalies. Ensure your internal security teams receive written confirmation of remediation. Verify that incident response plans account for potential denial-of-service events stemming from this specific vulnerability class.

What to do and how to stay safe: Microsoft

• Review inventory of all systems running .NET Core versions 8, 9, 10 or 11 to identify exposure.
• Apply the published patched versions (8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2) to all affected hosts.
• Monitor application logs for unexpected process terminations or stack-trace errors in DateTime handling.
• Restrict network access to services where immediate patching is not yet possible.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability actively being exploited?

The source material does not state whether the vulnerability is currently being exploited in the wild.

Does this affect .NET Framework?

The advisory specifically lists .NET Core runtime packages; it does not mention the legacy .NET Framework.

Are there workarounds available?

The material only mentions updating to the patched versions; no temporary mitigations are listed.