Microsoft.NETCore.App.Runtime.win-X64 (8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-Preview.1-11.0.0-Rc.1) - CraftedSignal Threat Feed

Denial of Service Vulnerability in .NET XML Components

hello@craftedsignal.io — Wed, 14 Oct 2026 00:33:03 +0000

Microsoft has disclosed a high-severity denial-of-service (DoS) vulnerability, tracked as CVE-2026-58280, affecting the System.Security.Cryptography.Xml and System.Private.Xml components within Microsoft .NET. The vulnerability, classified as CWE-674 (Uncontrolled Recursion), allows an unauthenticated attacker to cause excessive resource consumption and application crashes by supplying specially crafted XML inputs to vulnerable services.

The flaw exists in how the affected components handle XML processing, specifically related to entity references, DTD processing, and C14N transforms. By sending inputs designed to trigger deep recursion or inflate operation counts, an attacker can effectively disable services relying on these .NET libraries. Microsoft has addressed this in the latest .NET SDK and runtime releases by implementing stricter depth and operation count limits, disabling DTD processing by default, and validating entity references. Defenders must ensure all deployed .NET applications, including self-contained deployments, are updated to the patched versions to mitigate this risk.

Impact

Successful exploitation results in a denial-of-service condition, rendering affected .NET-based applications or services unresponsive. The vulnerability is network-exploitable, requires no authentication, and impacts a wide range of .NET versions (8.0, 9.0, 10.0, and 11.0-preview branches) across Windows, Linux, and macOS platforms. Given the ubiquity of .NET in enterprise backend services and public-facing APIs, this vulnerability poses a significant risk to service availability if left unpatched.

Recommendation

Update all .NET environments to the latest runtime versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.
Recompile and redeploy all self-contained applications targeting any of the impacted versions listed in the advisory.
Use the 'dotnet --info' command to audit currently installed versions across all development and production servers.
Monitor application logs for spikes in CPU usage or unexpected process terminations associated with XML parsing operations, which may indicate exploitation attempts.

Remote Code Execution in .NET System.Net.Sockets

hello@craftedsignal.io — Wed, 14 Oct 2026 00:32:45 +0000

Microsoft has disclosed a critical memory safety vulnerability, tracked as CVE-2026-70197, affecting the System.Net.Sockets component within the .NET runtime on Windows. The vulnerability stems from improper handling of cached native address buffers when a SocketAsyncEventArgs instance is reused across different types of datagram sockets, specifically transitioning between IPv4 and IPv6. Under these conditions, the internal buffer becomes undersized, permitting an out-of-bounds write during the execution of the ReceiveFromAsync operation. This flaw allows an unauthenticated, remote attacker to trigger memory corruption, which may lead to arbitrary code execution within the context of the application utilizing the vulnerable .NET runtime. The issue impacts multiple versions of .NET, including 8.0, 9.0, 10.0, and 11.0-preview releases on all Windows architectures.

Impact

Successful exploitation of CVE-2026-70197 could allow an unauthenticated attacker to execute arbitrary code with the privileges of the .NET application process. Given the nature of .NET applications often running as backend services or web servers, this could lead to full system compromise, data exfiltration, or lateral movement within the environment. All organizations running .NET applications on Windows should audit their environment for the impacted runtime versions and prioritize deployment of the specified patches.

Recommendation

Identify all vulnerable .NET applications by running dotnet --info on hosts to determine installed SDK and runtime versions.
Update the .NET runtime to the patched versions (8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2) across all development and production environments.
Recompile and redeploy all self-contained applications that target the vulnerable runtime versions.
Update Visual Studio to the latest version to ensure that associated .NET SDKs are correctly upgraded.
Monitor internal network traffic for anomalous socket communication patterns associated with datagram-heavy .NET services, as these may indicate attempts to trigger the buffer state conditions required for exploitation.