Microsoft .NET Framework
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Microsoft .NET Framework.
Recent Microsoft .NET Framework Security Advisories
| Advisory | Title | Published |
|---|---|---|
| CVE-2026-97801 | CVE-2026-97801 .NET Framework Tampering Vulnerability | October 13, 2026 |
| CVE-2026-108398 | CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerability | October 13, 2026 |
| CVE-2026-70007 | CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability | October 13, 2026 |
| CVE-2026-70035 | CVE-2026-70035 .NET Framework Remote Code Execution Vulnerability | October 13, 2026 |
| CVE-2026-70194 | CVE-2026-70194 .NET Framework Security Feature Bypass Vulnerability | October 13, 2026 |
| CVE-2026-97801 | CVE-2026-97801 .NET Framework Tampering Vulnerability | October 13, 2026 |
| CVE-2026-85363 | CVE-2026-85363 .NET Framework Elevation of Privilege Vulnerability | October 13, 2026 |
| CVE-2026-65810 | CVE-2026-65810 .NET Framework Elevation of Privilege Vulnerability | August 11, 2026 |
| CVE-2026-62897 | CVE-2026-62897 .NET Framework Remote Code Execution Vulnerability | August 11, 2026 |
| CVE-2026-62872 | CVE-2026-62872 .NET Framework Elevation of Privilege Vulnerability | August 11, 2026 |
By the Year
In 2026 there have been 35 vulnerabilities in Microsoft .NET Framework with an average score of 7.7 out of ten. Last year, in 2025 .NET Framework had 1 security vulnerability published. That is, 34 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.09
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 35 | 7.71 |
| 2025 | 1 | 8.80 |
| 2024 | 3 | 7.43 |
| 2023 | 11 | 7.88 |
| 2022 | 1 | 5.80 |
| 2021 | 0 | 0.00 |
| 2020 | 2 | 4.70 |
| 2019 | 1 | 6.50 |
| 2018 | 8 | 0.00 |
It may take a day or so for new .NET Framework vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Microsoft .NET Framework Security Vulnerabilities
Oct 2026: .NET Framework Tampering Vulnerability
CVE-2026-97801
7.5 - High
- October 13, 2026
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
Improper Validation of Specified Type of Input
Oct 2026: .NET Denial of Service Vulnerability
CVE-2026-58280
7.5 - High
- October 13, 2026
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
Stack Exhaustion
Oct 2026: Active Directory Federation Services (AD FS) Information Disclosure Vulnerability
CVE-2026-97788
7.5 - High
- October 13, 2026
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
Side Channel Attack
Oct 2026: .NET Denial of Service Vulnerability
CVE-2026-96960
7.5 - High
- October 13, 2026
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
Amplification
Oct 2026: .NET Denial of Service Vulnerability
CVE-2026-96959
7.5 - High
- October 13, 2026
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Allocation of Resources Without Limits or Throttling
Oct 2026: .NET Denial of Service Vulnerability
CVE-2026-96958
7.5 - High
- October 13, 2026
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient Algorithmic Complexity
Oct 2026: ASP.NET Core Denial of Service Vulnerability
CVE-2026-96233
7.5 - High
- October 13, 2026
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Memory Corruption
Oct 2026: .NET Framework Elevation of Privilege Vulnerability
CVE-2026-85363
8.8 - High
- October 13, 2026
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
Integer Overflow or Wraparound
Oct 2026: .NET Denial of Service Vulnerability
CVE-2026-84008
7.5 - High
- October 13, 2026
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient Algorithmic Complexity
Oct 2026: .NET Remote Code Execution Vulnerability
CVE-2026-83520
8.8 - High
- October 13, 2026
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Marshaling, Unmarshaling
Oct 2026: .NET Framework Remote Code Execution Vulnerability
CVE-2026-70035
8.8 - High
- October 13, 2026
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
Marshaling, Unmarshaling
Oct 2026: .NET Framework Remote Code Execution Vulnerability
CVE-2026-70007
8.8 - High
- October 13, 2026
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
Memory Corruption
Oct 2026: .NET Remote Code Execution Vulnerability
CVE-2026-96224
8.8 - High
- October 13, 2026
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
Memory Corruption
Oct 2026: Active Directory Federation Services (AD FS) Spoofing Vulnerability
CVE-2026-96222
7.4 - High
- October 13, 2026
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Improper Certificate Validation
Oct 2026: .NET Remote Code Execution Vulnerability
CVE-2026-70174
8.8 - High
- October 13, 2026
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
Improperly Implemented Security Check for Standard
Oct 2026: .NET Denial of Service Vulnerability
CVE-2026-69651
7.5 - High
- October 13, 2026
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient Algorithmic Complexity
Sep 2026: .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2026-69522
8.8 - High
- September 08, 2026
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
Heap-based Buffer Overflow
Aug 2026: .NET Core Remote Code Execution Vulnerability
CVE-2026-70354
7.8 - High
- August 11, 2026
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
Memory Corruption
Aug 2026: .NET Framework Elevation of Privilege Vulnerability
CVE-2026-65810
7.8 - High
- August 11, 2026
Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
Relative Path Traversal
Aug 2026: .NET Elevation of Privilege Vulnerability
CVE-2026-62886
7.8 - High
- August 11, 2026
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
Integer Overflow or Wraparound
Aug 2026: .NET Framework Elevation of Privilege Vulnerability
CVE-2026-62872
8.8 - High
- August 11, 2026
Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
AuthZ
Aug 2026: .NET Framework Remote Code Execution Vulnerability
CVE-2026-62897
7 - High
- August 11, 2026
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
Integer Overflow or Wraparound
Jul 2026: .NET Spoofing Vulnerability
CVE-2026-50659
6.5 - Medium
- July 14, 2026
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
Output Sanitization
Jul 2026: .NET Remote Code Execution Vulnerability
CVE-2026-50649
7.8 - High
- July 14, 2026
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
Marshaling, Unmarshaling
Jul 2026: .NET Denial of Service Vulnerability
CVE-2026-50525
7.5 - High
- July 14, 2026
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Allocation of Resources Without Limits or Throttling
Jul 2026: .NET Security Feature Bypass Vulnerability
CVE-2026-47304
8.1 - High
- July 14, 2026
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Improper Verification of Cryptographic Signature
Jul 2026: Active Directory Federation Server Denial of Service Vulnerability
CVE-2026-50647
7.5 - High
- July 14, 2026
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Infinite Loop
Jul 2026: Windows Active Directory Federation Services Denial of Service Vulnerability
CVE-2026-50411
7.5 - High
- July 14, 2026
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Stack Overflow
Jul 2026: Windows Active Directory Federation Services Denial of Service Vulnerability
CVE-2026-50355
7.5 - High
- July 14, 2026
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
Stack Overflow
Jul 2026: Windows Active Directory Federation Services Denial of Service Vulnerability
CVE-2026-50324
5.9 - Medium
- July 14, 2026
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Infinite Loop
Jul 2026: Windows Active Directory Federation Services Denial of Service Vulnerability
CVE-2026-50368
7.5 - High
- July 14, 2026
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
Stack Overflow
Jul 2026: Windows Active Directory Federation Services Denial of Service Vulnerability
CVE-2026-50304
7.5 - High
- July 14, 2026
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
Stack Overflow
Jul 2026: Azure Active Directory Denial of Service Vulnerability
CVE-2026-50652
7.5 - High
- July 14, 2026
Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
Marshaling, Unmarshaling
Jul 2026: Azure Active Directory Denial of Service Vulnerability
CVE-2026-50653
7.5 - High
- July 14, 2026
Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.
Infinite Loop
Apr 2026: .NET Framework Denial of Service Vulnerability
CVE-2026-32226
5.9 - Medium
- April 14, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
Race Condition
Jan 2025: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21176
8.8 - High
- January 14, 2025
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Buffer Over-read
Oct 2024: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2024-43483
7.5 - High
- October 08, 2024
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
Inefficient Algorithmic Complexity
Oct 2024: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2024-43484
7.5 - High
- October 08, 2024
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
Inefficient Algorithmic Complexity
Jul 2024: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2024-38081
7.3 - High
- July 09, 2024
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
insecure temporary file
Microsoft XAML Diagnostics Elevation of Privilege Vulnerability
CVE-2023-36003
7.3 - High
- December 12, 2023
XAML Diagnostics Elevation of Privilege Vulnerability
Nov 2023: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-36049
7.6 - High
- November 14, 2023
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
Improper Input Validation
Nov 2023: ASP.NET Security Feature Bypass Vulnerability
CVE-2023-36560
8.8 - High
- November 14, 2023
ASP.NET Security Feature Bypass Vulnerability
Sep 2023: Visual Studio Remote Code Execution Vulnerability
CVE-2023-36796
7.8 - High
- September 12, 2023
Visual Studio Remote Code Execution Vulnerability
Integer underflow
Sep 2023: Visual Studio Remote Code Execution Vulnerability
CVE-2023-36794
7.8 - High
- September 12, 2023
Visual Studio Remote Code Execution Vulnerability
Integer underflow
Sep 2023: .NET Framework Remote Code Execution Vulnerability
CVE-2023-36788
7.8 - High
- September 12, 2023
.NET Framework Remote Code Execution Vulnerability
Sep 2023: Visual Studio Remote Code Execution Vulnerability
CVE-2023-36792
7.8 - High
- September 12, 2023
Visual Studio Remote Code Execution Vulnerability
Integer Overflow or Wraparound
Sep 2023: Visual Studio Remote Code Execution Vulnerability
CVE-2023-36793
7.8 - High
- September 12, 2023
Visual Studio Remote Code Execution Vulnerability
Heap-based Buffer Overflow
Aug 2023: ASP.NET Elevation of Privilege Vulnerability
CVE-2023-36899
8.8 - High
- August 08, 2023
ASP.NET Elevation of Privilege Vulnerability
Improper Input Validation
Aug 2023: .NET Framework Spoofing Vulnerability
CVE-2023-36873
7.4 - High
- August 08, 2023
.NET Framework Spoofing Vulnerability
Improper Input Validation
Apr 2023: .NET DLL Hijacking Remote Code Execution Vulnerability
CVE-2023-28260
7.8 - High
- April 11, 2023
.NET DLL Hijacking Remote Code Execution Vulnerability
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Microsoft .NET Framework or by Microsoft? Click the Watch button to subscribe.
