CVE-2026-70197

Timing: Microsoft first disclosed this flaw on 13 October 2026. The fix shipped only on 25 October 2026.

CVE-2026-70197 is an out-of-bounds write in System.Net.Sockets, on Windows only.

Microsoft explains the trigger. An app reuses one SocketAsyncEventArgs object across IPv4 and IPv6 datagram sockets. The object can keep a cached native address buffer that is too small. A later ReceiveFromAsync call can then write past it.

MSRC says an unauthenticated attacker could send a crafted packet to an affected service and run code. It notes high attack complexity. Success depends on the environment and configuration.

Microsoft scores it CVSS 3.1 8.1 (High) and rates it Important. The full vector is in the CVSS field. NVD shows the Microsoft score only and has not analysed it yet.

What the 13 October fix missed. Microsoft says the fix "was not included in the previous updates". So .NET 8.0.32, 9.0.21, 10.0.13 and 11.0 RC2 are still affected. On 19 October MSRC said the flaw was not addressed and that a complete fix was in testing.

Fixed versions (25 October): .NET 8.0.33, 9.0.22, 10.0.14 and 11.0.0-rc.3.26522.148. The revised advisory also lists the .NET 8 Mono runtime packs for Windows. Self-contained apps must be rebuilt and redeployed.

The CVE record also lists Visual Studio 2019, 2022 and 2026 builds. Check Visual Studio updates if you install SDKs through it.

Microsoft credits Ky0toFu, s3zer0 and h4urek with secsys lab, Aobo Wang, and an anonymous reporter. MSRC says it was not publicly disclosed or exploited. It is not in CISA KEV (catalog 2026.10.23, checked 26 October). ThreatWire found no public proof of concept.

Read the full .NET out-of-band explainer.