CVE-2026-70197

Name of the Vulnerable Software and Affected Versions Microsoft.NETCore.App.Runtime.win-arm versions 8.0.0 through 8.0.31 Microsoft.NETCore.App.Runtime.win-arm64 versions 8.0.0 through 8.0.31 Microsoft.NETCore.App.Runtime.win-x64 versions 8.0.0 through 8.0.31 Microsoft.NETCore.App.Runtime.win-x86 versions 8.0.0 through 8.0.31 Microsoft.NETCore.App.Runtime.win-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.win-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.win-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.win-x86 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.win-arm versions 9.0.0 through 9.0.20 Microsoft.NETCore.App.Runtime.win-arm64 versions 9.0.0 through 9.0.20 Microsoft.NETCore.App.Runtime.win-x64 versions 9.0.0 through 9.0.20 Microsoft.NETCore.App.Runtime.win-x86 versions 9.0.0 through 9.0.20 Microsoft.NETCore.App.Runtime.win-arm versions 10.0.0 through 10.0.12 Microsoft.NETCore.App.Runtime.win-arm64 versions 10.0.0 through 10.0.12 Microsoft.NETCore.App.Runtime.win-x64 versions 10.0.0 through 10.0.12 Microsoft.NETCore.App.Runtime.win-x86 versions 10.0.0 through 10.0.12

Description An out-of-bounds write in System.Net.Sockets on Windows allows an unauthenticated attacker to execute code over a network. The issue occurs when a SocketAsyncEventArgs instance is reused across IPv4 and IPv6 datagram sockets, which can retain an undersized cached native address buffer. This leads to an out-of-bounds write during the ReceiveFromAsync() function.

Recommendations Update Microsoft.NETCore.App.Runtime.win-arm versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.NETCore.App.Runtime.win-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.NETCore.App.Runtime.win-x64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.NETCore.App.Runtime.win-x86 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.NETCore.App.Runtime.win-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2. Update Microsoft.NETCore.App.Runtime.win-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2. Update Microsoft.NETCore.App.Runtime.win-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2. Update Microsoft.NETCore.App.Runtime.win-x86 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2. Update Microsoft.NETCore.App.Runtime.win-arm versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.NETCore.App.Runtime.win-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.NETCore.App.Runtime.win-x64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.NETCore.App.Runtime.win-x86 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.NETCore.App.Runtime.win-arm versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.NETCore.App.Runtime.win-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.NETCore.App.Runtime.win-x64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.NETCore.App.Runtime.win-x86 versions 10.0.0 through 10.0.12 to version 10.0.13. Restart applications after updating the runtime or SDK. Rebuild and redeploy self-contained applications targeting the affected versions.